Microsoft Issues Zero-Day Attack Alert For Word

0xbl00d writes "Eweek.com is reporting a new Microsoft Word zero-day attack underway. Microsoft issued a security advisory to acknowledge the unpatched flaw, which affects Microsoft Word 2000, Microsoft Word 2002, Microsoft Office Word 2003, Microsoft Word Viewer 2003, Microsoft Word 2004 for Mac and Microsoft Word 2004 v. X for Mac. The Microsoft Works 2004, 2005 and 2006 suites are also affected because they include Microsoft Word. Simply opening a word document will launch the exploit. There are no pre-patch workarounds or anti-virus signatures available. Microsoft suggests that users 'not open or save Word files,' even from trusted sources."

Comments

Microsoft Recommends..

[sylvainsf]

That the business world just stop for a few minutes(days, weeks) while they fix this.

Re:Microsoft Recommends..

[Anonymous Coward]

I wish Microsoft were a person. Then I could go up and kick that person in the nuts.

Re:Microsoft Recommends..

[Deep Fried Geekboy]

Get a Mac. Both Pages and TextEdit will open and translate .doc files directly.

Re:Microsoft Recommends..

[PsychicX]

The slashot summary is deceptive (probably deliberately). From TFA:

Do not open or save Word files that you receive from un-trusted sources or that you receive unexpectedly from trusted sources.

The point is that there is a danger that a trojan on someone else's machine could start spreading infected Word files inside a corporation, or just amongst friends. Note furthermore:

The vulnerability cannot be exploited automatically through e-mail. For an attack to be successful a user must open an attachment that is sent in an e-mail message.

Users whose accounts are configured to have fewer user rights on the system could be less affected than users who operate with administrative user rights.

It can't be triggered automatically, and limited accounts (like every Vista system) will be largely unaffected. (Because exploits will usually try to root the box or install something, both of which will be prevented.)

Also observe that Office 2007 isn't affected. Obviously MS is doing something right in the next generation of their products.

Re:Microsoft Recommends..

[JoGlo]

Oooooh! She wouldn't like that!

Re:Microsoft Recommends..

[ewl1217]

Also observe that Office 2007 isn't affected. Obviously MS is doing something right in the next generation of their products.

You mean like not releasing them yet?

Re:Microsoft Recommends..

[Brewskibrew]

Get a stone tablet and a chisel. Those will also translate Word documents as well as make handy weapons for when your Microsoft Account Manager pops into your office.

Re:Microsoft Recommends..

[Anonymous Coward]

Also observe that Office 2007 isn't affected. Obviously MS is...

Obviously Microsoft is updating their old programs to have exploits that their new ones don't. And before you say prove it, you prove they are not. Microsoft keeps its source code closed. They release updates these days like crazy. It would be a simple task for them to align their old products to be vulnerable and, of course, insure their new product is not vulnerable to some zero-day exploit that comes along just as they need some reason to tout their shiny new product.

Why are Word documents able to get infected like this? Why does the infection affect so many old Microsoft products (and ones currently in use) but not the next version of these products Microsoft just released? You attribute it to improved security. I attribute it to an improvement in marketing ploys by a company known for doing anything it takes to get you locked into their product.

What is the real solution Microsoft is suggesting? Don't open Word documents or upgrade to Office 2007. It is as simple as that. And much more than probably deliberate.

Re:Microsoft Recommends..

[Firehed]

As will OpenOffice.org on all platforms. That's not the point - how on earth can someone code so sloppily that a WORD PROCESSOR has a serious security exploit?! And more importantly, what feature in aforementioned WORD PROCESSOR requires *anything* that could pose a security issue?

Maybe the notion of writing all my papers in HTML wasn't so insane after all... no more of these archaic "pages", and it would certainly be a more reliable way of turning in assignments than e-mail attachments. Take care of a formatting stylesheet once, and from there on it's just using the <p> tag to full appropriateness.

Re:Microsoft Recommends..

[cultrhetor]

Move along...nothing to see here.

Re:Microsoft Recommends..

[sumdumass]

This is why they are so apposed to ODF or anything else that lets some you access the sat you open from more then one program freely. They know a slip up like this would force everyone to try the competition out.

Re:Microsoft Recommends..

[Anonymous Coward]

Wow... should be access the data you own not the sat you open. I think the spell checker got liberal or something.

Re:Microsoft Recommends..

[eggegick]

I've never worked anywhere, large company or small, where the systems were not set up with admin accounts.

Re:Microsoft Recommends..

[ergo98]

The Slashdot summary is deceptive (probably deliberately).

It's probably closer to the mark than "receive unexpectedly". If someone in a corporation became infected, and they infect documents on a shared network location -- game over. Other users don't have to "receive" it via a classic-email virus, but rather they just have to go about their daily business. You touched on this yourself, and it is why this does basically mean "there be dragons" for all word files in corporations.

It can't be triggered automatically, and limited accounts (like every Vista system) will be largely unaffected.

Phew! Now that we know that the burgeoning community of Vista users will be "largely unaffected", we're safe! That comprises the set that downloaded and installed the RTM from MSDN, so at a minimum, around an installed base comparable to QNX.

In any case, "largely unaffected" is more deceptive than the Slashdot summary (which came right from Cnet) -- the risk of compromises nowadays are seldom that they'll reconfigure your drivers or repartition your drive, thus requiring admin rights (when was the last time a virus was actually maliciously destructive in such a manner?), but rather that they'll compromise data integrity/security. If Bob is a normal user, but he's in HR and thus has rights to HR information, then so does an exploit running as Bob the unprivileged numbers-monkey.

Re:Microsoft Recommends..

[kisielk]

It's not really deceptive, I often get attachments from almost everyone I regularly correspond with without expecting them first. Am I supposed to now call or email everyone I know every time they send me something to confirm that they intended to?

As for being hardly affected, it simply says LESS affected. What's to prevent the trojan from taking over your Outlook client and using it to send spam and propagate itself to everyone you know as well. Doesn't take root to do that, nor countless other things.

Re:Microsoft Recommends..

[sumdumass]

Obviously Microsoft is updating their old programs to have exploits that their new ones don't. And before you say prove it, you prove they are not.

One way to find out might be to do a fresh install, find one of these virus' that exploit it and then patch it until it breaks. Unless your suggesting the exploit always existed but Microsoft just made it know today to pump sales of a new product.

It wouldn't surprise me if any of this was actually true. You've heard the old anti virus vendors making virus to stimulate sales bit, and I've always hear Microsoft claiming the newest version of whatever is more stable, secure and a better user experience. It makes you wonder how much truth to that there is.

Re:Microsoft Recommends..

[carpeweb]

Mod parent up.

I guess "requirements" is a fuzzy enough concept, and even fuzzier with shrink-wrap, since the software company has to serve as proxy for the future users when developing. Before anyone says "but a good software company would engage end-users up front", I agree. But the software company still has to decide which future users to bring into that process (assuming they even bother), and ends up prioritizing the requirements, anyway. I guess it was just too obvious to specify a requirement for a word-processor along the lines of "don't allow the software to be used to trash the computer that I had to buy to run the software".

Writing good, complete requirements is hard.

But I don't think this one was really that hard.

Re:Microsoft Recommends..

[mikael]

how on earth can someone code so sloppily that a WORD PROCESSOR has a serious security exploit?!

The usual reason - a local buffer created from the stack set to a fixed size. ie.

char cbuf[MAX_BUFFER];

I would guess that the Microsoft Word document file will be arranged using a chunk data format:
file header followed by object headers with type, version, length, followed by binary data for that object
In this way, unknown chunks can just be skipped over.

It would be no surprise that each programmer coding a particular object (formula, table) would assume that only
they would be theonly one writing read/write routines for their particular object, and choose to use a local stack
buffer to store the raw binary data, before converting it to the internal data structure.

When reading the document, they would just read the header as normal (type,version,length), then read the specified
amount of object data without checking the validity of the length.

And it only takes one programmer to make this mistake in order to create a security vulnerability that compromises
the entire application. Get the right type of data in the Word document, and you could theoretically load and execute
some executable code stored the file.

Re:Microsoft Recommends..

[PCMeister]

Also observe that Office 2007 isn't affected. Obviously MS is doing something right in the next generation of their products.

While that may be the case, users will **HAVE TO PAY** for this "next generation" product and implied protection against such attacks.

Obviously, the days of opening up a document without the spectre of having a system wide issue are long gone! What a shame...

Incase anybody's interested, the prices are as follows:

Microsoft Office Ultimate 2007 New! $679/$539
Microsoft Office Professional 2007 $499/$329
Microsoft Office Small Business 2007 $449/$279
Microsoft Office Standard 2007 $399/$239
Microsoft Office Home and Student 2007 $149/NA

[Source]

Re:Microsoft Recommends..

[Moron_Programmer]

I'd rather kick in the nuts the guy who takes advantage of these 'exploits'. They cease to be exploits when there are none willing to exploit them.

Re:Microsoft Recommends..

[jbourj]

Also observe that Office 2007 isn't affected. Obviously MS is doing something right in the next generation of their products.

Are you sure that they didn't mention it because it isn't commercially available yet? I mean, a virus would have a hard time running rampant on a small population of pre-release machines. (I know they released it to corporate customers recently, but anything if Amazon tells me that I cannot even pre-order something, then is not on the market as far as I'm concerned.)

Re:Microsoft Recommends..

[ssundberg]

Also observe that Office 2007 isn't affected

And neither is Office 97 ... which I still use, even on my XP.

Re:Microsoft Recommends..

[Anonymous Coward]

[Source]

Yeah right! No way am I going to open a Work .doc to check that!

Re:Microsoft Recommends..

[einhverfr]

Right. After all, the *only* truly secure software is the software that doesn't exist (at least as of yet).

Re:Microsoft Recommends..

[sumdumass]

Am I the only one who read this (about the stone tablet) and pictured Ballmer throwing a chair across the room screaming Nature infringes on Microsoft's patent ip? then mumbling expletives about stones?

Re:Microsoft Recommends..

[kestasjk]

Remember the massive bundle of critical OS X security updates a week ago which patched holes that were being exploited for months?

• "Who cares about these critical vulnerabilities, as long as there's no spyware?"
• "Microsoft probably fixes loads of security bugs that they don't tell anyone about"
• "The remote/web vulnerabilities can't do any damage because users don't run as admin!"
• "The local admin privilege escalation vulnerabilities don't matter, because they're just local!"
• > (tagging beta)

Then Microsoft lets everyone know the moment an 0-day vulnerability is released which exploits a bug in Word.

• "I'd like to kick MS in the balls"
• "Why can't MS learn from Apple?"
• "It's lucky we use Macs where I work"
• "Read what Linus wrote about this vulnerability here: linus.doc"
• > haha, pwned, roflolmao (tagging beta)

Some people here make Slashdot seem like a parody of itself..

Re:Microsoft Recommends..

[cloricus]

Is the GP just an out right moron?

(Serious non-flaming post ahead so don't mark me troll before at least reading!)

Putting aside your Microsoft fanboy attitude of 'oh just buy the next version and all will be well!' lets look at this objectively. And for the sake of being kind I wont go into details of how painful this will be for business in general; Sticking to the simple points will do just find to point out how horrible this is.

> Do not open or save Word files that you receive from un-trusted sources or that you receive unexpectedly from trusted sources.

Now you sound new to the world of tech as you haven't been embittered against Microsoft so I'll give you a break on this one. End users have two types of authentication; 'This looks shiny' *click* and 'Oh I know this person' *click*. So in reality the summary is an effective warning and really if some one in a business gets a document saying AccountsNov06.doc who is to say it is expected or unexpected - some one sent you the accounts and a nice little social engineering spiel to lure you to the click. Yes boss, three bags full boss.

> The vulnerability cannot be exploited automatically through e-mail. For an attack to be successful a user must open an attachment that is sent in an e-mail message.

> It can't be triggered automatically, and limited accounts (like every Vista system) will be largely unaffected. (Because exploits will usually try to root the box or install something, both of which will be prevented.)

See previous post about *clicky*. If you boss tells you to deal with AccountsNov06.doc then you deal with AccountsNov06.doc and that usually, if I'm not mistaken, involves opening it for a start. Also largely unaffected; what does that really mean? There will be a box come up saying 'Click me like you usually do as I get in the way of every simple task' because let me tell you as a system administrator even I started clicking them without thinking after two hours of testing Vista. Finally on this topic users who have limited accounts is a joke - even with your AD locking down almost all of the system most places still allow execution of applications and scripts which may have decent root kitting abilities that bypass user rights - only high schools and net cafes go the whole nine yards.

And lastly you have the gem of saying Microsoft is great because their next product line isn't affected. I think the parent to this post addressed this point perfectly with the following:

> You mean like not releasing them yet?

Which points out the flaw in your argument very nicely. Still it is worth expanding for those unfamiliar with Office 2k7 in that a) it implements a new XML document format which has nothing to do with .doc so isn't affected and b) they have time to fix their .doc filter layer so this doesn't happen in the wild under 2k7 - in fact I'd almost wager a decent price that the current release of Office 2k7 floating around the MS offices has the flaw and if it doesn't I'd be raising questions that this was a stunt to force upgrades and kill off .doc faster.

Either way before you mouth off at Slashdot consider the topic and its implications to users and business first; there are many real Slashdot exaggerations that are stabs at Microsoft and this isn't one of them. Some times it is apt to say that Microsoft really did drop the ball.

Re:Microsoft Recommends..

[Mike89]

Get a Mac. Both Pages and TextEdit will open and translate .doc files directly.

What a terrific, cheap sulution to the problem! Thank you, Deep Fried Geekboy.

Re:Microsoft Recommends..

[Anonymous Coward]

Quarriers! Quarriers! Quarriers!

Re:Microsoft Recommends..

[mackyrae]

I thought they were 0day til someone exploits them, then they're "oh shit."

Re:Microsoft Recommends..

[cloricus]

I like to call it the Script Kiddies (Windows Techies) vs System Admins (UNIX Users) paradox (a lose meaning of the word). The Script Kiddies have greater numbers (brute force) to get their message out while the System Admins have louder voices due to their higher karma which was earnt by being informative and insightful. Thus you have your imbalance.

Oh, btw I fit squarely into your latter listing, and I'm modest too! :D

Re:Microsoft Recommends..

[spidkit]

Actually, corporations are viewed as "persons", legally, with personal "rights". Be intelligent and don't deny your wish. Kick the laws that made them - and vote accordingly to change them.

Re:Microsoft Recommends..

[OldManAndTheC]

Get a stone tablet and a chisel.

Actually Microsoft is going to release a product for that very format.

They plan to call it Microsoft Word 2007 BC.

And in an even weirder twist, because the product release schedule slipped they had to change the original name: Microsoft Word 2009 BC

Re:Microsoft Recommends..

[Hes Nikke]

if you email me the css files you use, i'll buy you a bear! i'll buy the bear for everyone in the house (the bar, not this thread!) if you email me your css files. oh, and don't forget to cc css files. :)

Re:Microsoft Recommends..

[Overly Critical Guy]

The summary isn't deceptive at all. You can't even trust trusted sources.

Re:Microsoft Recommends..

[Fred_A]

This is becoming increasingly rare in my experience, even where people are rather clueless in things Microsoft related. Of course with these things you get to see all kinds (unfortunately).

Re:Microsoft Recommends..

[Fred_A]

Also observe that Office 97 isn't affected either. I know a lot of people that must be glad they didn't upgrade ;)

Re:Microsoft Recommends..

[ultranova]

I'd rather kick in the nuts the guy who takes advantage of these 'exploits'. They cease to be exploits when there are none willing to exploit them.

A broken lock is a broken lock even if no one takes advantage of that fact.

Re:Microsoft Recommends..

[ultranova]

The usual reason - a local buffer created from the stack set to a fixed size.

Yet another good reason to code all future applications in Java or some other language with mandatory (meaning it cannot be turned off no matter how sure the programmer is of himself) bounds checking.

Cue a dozen replies telling how they don't need it since only an idiot would make that kind of error... Guess what, people: I'm sick and tired of exploits and random crashes. Switch to Java and leave C/C++ to system programmers, please !

Re:Microsoft Recommends..

[ephix]

well, there is a certain guy called Bill Gates.

Re:Microsoft Recommends..

[lukas84]

Office 2007 is commercially available if you're a software assurance/volume licensing customer.

However, I seriously doubt that even ONE of them has already rolled out office 2007.

but anything if Amazon tells me that I cannot even pre-order something, then is not on the market as far as I'm concerned.

So there are no commercially available cars?

Re:Microsoft Recommends..

[Overly Critical Guy]

Remember the massive bundle of critical OS X security updates a week ago which patched holes that were being exploited for months?

No, I don't, because nothing was "being exploited for months," and you can't cite a single incident to back up that claim. You just made it up on the spot.

None of the patches were zero-day exploits, and most were patches of UNIX utilities, not Apple software.

Have fun screening all your email from all your contacts in Outlook.

Re:Microsoft Recommends..

[Anonymous Coward]

Ummm.... Office 2007 has already been released for Enterprises. And no, it doesn't have this flaw, even though it CAN open & save 2003 format.

Re:Microsoft Recommends..

[rassie]

The vulnerability cannot be exploited automatically through e-mail. For an attack to be successful a user must open an attachment that is sent in an e-mail message. That's no different than when I receive .exe's or .pif's or .scr's. So I am looking forward to an update to Outlook which automatically blocks .doc attachments.

Re:Microsoft Recommends..

[kestasjk]

No, I don't, because nothing was "being exploited for months," and you can't cite a single incident to back up that claim. You just made it up on the spot.

No, I didn't:

"It probably took about 20 or 30 minutes to get root on the box. Initially I tried looking around the box for certain mis-configurations and other obvious things but then I decided to use some unpublished exploits -- of which there are a lot for Mac OS X," gwerdna told ZDNet Australia .

None of the patches were zero-day exploits, and most were patches of UNIX utilities, not Apple software.

Read the list. I count 13 out of 22 of the vulnerabilities are in Apple's code. Who's making things up on the spot here?
None of them are zero-day exploits? Checking one of the UNIX utility vulnerabilities (because these are the only ones that we know when they were discovered) the perl vulnerability was discovered in December 2005.
With this Word vulnerability MS discovered its use in the wild, and they've let everyone know and are working on a patch. With that perl vulnerability, and probably others in the list, it was discovered in 2005 and Apple only get around to releasing a patch now.
At least you're right that that's not zero-day; that's negative-three-hundred-and-sixty-five-day.

Have fun screening all your email from all your contacts in Outlook.

I don't have to screen anything; I just won't open any Word documents. Look at the list above from Apple; you would have had to screen e-mail for HTML, new fonts, turn off your wireless card, not use any Windows shares, not go to any links to web pages given in e-mails, not go to any suspect web pages, etc, etc. The only difference is that Apple don't post security bulletins giving people warning, that might damage sales.
Have fun having a false sense of security though.

Re:Microsoft Recommends..

[Nasarius]

Maybe the notion of writing all my papers in HTML wasn't so insane after all

You want LaTeX. If you're running KDE, you can't beat Kile as an editor.

Re:Microsoft Recommends..

[digitalcowboy]

One way to find out might be to do a fresh install ... then patch it until it breaks.

In a world without Microsoft that sentence would be funny. Thanks to Microsoft it's quite often a sad reality.

Re:Microsoft Recommends..

[umghhh]

is it not a wonder that it just comes when new release is (almost) there? I find it fascinating that every time a big corporation comes up with a new major release, suddenly the old stuff is so dangerous, inefficient and expensive to use that one stuns how on earth anybody bought such crap in the first place.
PR - this is the job I should have chosen instead of bits and bytes.

Re:Microsoft Recommends..

[Anonymous Coward]

Yeah, I really want to submit users to random hangs while the Java VM garbage collects itself. Not to mention that yes, speed does matter, so until you can actually show some evidence of real-life shrink-wrapped applications running just as fast on a VM as on the metal, I think we'll stick with C++ (trust me, repagination is a lot of work, and it's already bad enough in long documents). Fix those problems and we'll talk, and no, linking to an academic paper that you've found on TFW doesn't count as fixing anything. And if you think Word's too complex and shouldn't be doing that much work, you know where to find notepad (or vi), but good luck making professional documents; I'm fairly certain that most of our 500 million customers will stick with Word.

Re:Microsoft Recommends..

[Anonymous Coward]

Presuming, of course, that you're not suggesting M$ would release something early, if a date in BC slips, the number would decrease, not increase.

Big BC dates = older
Small BC dates = newer
2009BC is two years BEFORE 2007BC.

</pedant>

Re:Microsoft Recommends..

[Anonymous Coward]

Did you notice that the exploit doesn't work on Word 12? Maybe the developers have actually noticed these "buffer overflow" thingamajigs. True, there was some darn stupid file open code, but the XML file format makes this particular brand of overflows go away (or at least makes them an order of magnitude harder to introduce).

Re:Microsoft Recommends..

[Anonymous Coward]

I always wanted a pet bear...

Re:Microsoft Recommends..

[MLopat]

End users have two types of authentication; 'This looks shiny' *click* and 'Oh I know this person' *click*.

So your end users in this case are pre-school children? or are you saying they just have that mental capacity.

I take the time to educate my clients about any software that we load onto their system, especially when vulnerabilities arise. And when in doubt, they contact me.

Re:Microsoft Recommends..

[ultranova]

Yeah, I really want to submit users to random hangs while the Java VM garbage collects itself. Not to mention that yes, speed does matter, so until you can actually show some evidence of real-life shrink-wrapped applications running just as fast on a VM as on the metal, I think we'll stick with C++ (trust me, repagination is a lot of work, and it's already bad enough in long documents).

Given the choice between random sub-second hangs and random crashes with occassional virus infection, I'll take the former any day. Besides, modern VMs compile everything to machine code prior to execution (JIT), so there shouldn't be any significant speed penalty to them - and there isn't, as far as I can tell.

And if you think Word's too complex and shouldn't be doing that much work, you know where to find notepad (or vi), but good luck making professional documents; I'm fairly certain that most of our 500 million customers will stick with Word.

I guess they'll be seeing a lot of exploits in the future too, then.

Re:Microsoft Recommends..

[LordSnooty]

It can't be triggered automatically, and limited accounts (like every Vista system) will be largely unaffected. (Because exploits will usually try to root the box or install something, both of which will be prevented.)

Is this supposed to make me feel better?

You take the same line as Microsoft might - "of course, if you'd bought our latest version..."

I'd also argue that being hit when opening what should be no more than a text file with some formatting instructions is pretty shoddy, whether you're on a restricted account or not.

Re:Microsoft Recommends..

[somersault]

I think writing letters and crap would be more effective than 'voting'. As far as I can see, there are only 2 real parties to vote for in the USA. Just how are they going to know that your vote means you want them kicking Microsoft in the nuts?

Re:Microsoft Recommends..

[cofaboy]

this is a very valid point, things cn become too complex to be useful. It would appear the MS products are approaching this limit at a fast rate of knots. PS I posted because I screwed moderation on you :P

Re:Microsoft Recommends..

[theredia]

Also observe that Office 2007 isn't affected. Obviously MS is doing something right in the next generation of their products.

They just forgot to insert this bug... I'll file a case to assure it's included.

Re:Microsoft Recommends..

[charlieman]

Why don't just use latex?

Re:Microsoft Recommends..

[Anonymous Coward]

Not to mention that yes, speed does matter,

We're talking about Word here. Speed has already been sacrificed. We're also talking about business users, so we assume there is a corporate network. I mean, if you're attached to a corp network, it takes 5 entire minutes just to start. And you have random hangs when it auto-saves to some profile sitting on a machine in another country.

YMMV.

Re:Microsoft Recommends..

[glesga_kiss]

how on earth can someone code so sloppily that a WORD PROCESSOR has a serious security exploit?!

Buffer overflows aside, a legitimate exploit hole is Macro programming. Most people are scared of macros and have never looked into them, but they are extremely powerful. However, with that power comes a cost. Want to read/write CSV data? Fine, but the same disk I/O functionality could be used to install a trojan payload to a startup script.

Oh, and I'm fairly sure that vi has had a couple of buffer-overflow issues over the years. Anything that deals with external data comes with a risk.

Re:Microsoft Recommends..

[kestasjk]

Sorry. What part of the quote from the article:

Participants were given local client access to the target computer and invited to try their luck.

Did you not understand?

We are talking about a zero day exploit from an email attachment here - not someone getting an elevated access level AFTER being give a user account on the effected machine.

If I understand you right you are saying OS X is secure because the rm-my-mac-mini competition wasn't realistic.

First off I only referenced it to show the GP that exploits for these vulnerabilities do exist in the wild, and had been in the hands of hackers for months. Something which he thought I "made up on the spot".
As regards your specific point, if the rm-my-mac-mini competition instead allowed the attackers to submit HTML, which would automatically be rendered in Safari (a more true to real life scenario), vulnerabilities still existed which could have been used to get root privileges.

Before you reply saying "That's still unrealistic. You shouldn't render suspect HTML, or connect to suspect wireless networks, or visit suspect Windows shares, or look at suspect directories in Finder. Realistically no-one would run into those OS X vulnerabilities.", perhaps I'd say that realistically no-one would download and look at a word document from an e-mail attachment that they weren't expecting. I know I wouldn't.

Re:Microsoft Recommends..

[morie]

Probably why he noted that 2007 BC is the altered name of a delayed project 2009 BC...

Re:Microsoft Recommends..

[irwtdvoys]

Or is it always insecure because it isn't finished...? 10 PRINT "Microsoft Word is secure." 20 PRINT "No wait!" 30 PRINT "Microsoft Word is not secure" 40 PRINT "No wait!" 50 GOTO 10

Re:Microsoft Recommends..

[cloricus]

Both of your examples are the same thing; Preschool children by definition have the mental capacity of preschool children. In any case I stand by my claim which is based on several years of observation of this very problem as I wanted to see how they could fail so badly at basic authentication and fall for scams/spams/etc.

Also it is nice that you have time and the interest to educate your clients and I commend you (please assume no sarcasm in that line). Unfortunately as per a generalisation I do not believe your case is common and then of no important to the claim. Also many sys admins are in the added disadvantage that those who break the system are equal to them in standing and prefer to run their own affairs as they are 'grown ups who can tell the difference between right and wrong'...And seriously what can you say against that? While I will say they are pre-school children when it comes to computer based personal authentication I would never say it to their faces as they simply wouldn't understand the context and scope it was meant in. You may reply that I'm not giving my users enough credit...Though that is another argument which I'm not going to go into.

Note that our users also contact us when they are in doubt...Though it is rare that a doubtful response comes back from their 'friend' or 'shiny' assessment of a seemingly (to them) authentic email.

Re:Microsoft Recommends..

[TheRaven64]

trust me, repagination is a lot of work, and it's already bad enough in long documents

I don't use a word processor, I use LaTeX, which seems to have much better layout rules than any version of Word I have seen. The document I am working on is around 200 pages. Compiling it (including invoking gnuplot to draw a load of graphs, pulling in a few code files and syntax highlighting them, constructing an index and bibliography, and making sure all cross-references are correct) takes 7 seconds of wall time on my current laptop, and most of that is time spent waiting for I/O.

Oh, and much of the typesetting code used by LaTeX is written as interpreted macros that are run by the TeX runtime system. If it were all hard-coded, even in Java, it would be even faster.

Earlier this year, I saw a demo of a typesetting system written in Smalltalk (and running in the Squeak VM) that represented every character as an object, with simple rules (e.g. stay next to next character, jump to next line if you are over the margin, jump to the end of line if there is only whitespace between you and the end of line). It ran very fast; he dragged an image across a multi-page document, and the text re-flowed around it, and the entire thing was written in a couple of pages of Smalltalk.

If pagination is slow in Word, then I can only imagine it's because the developers need replacing.

Re:Microsoft Recommends..

[gad_zuki!]

>but rather that they'll compromise data integrity/security.

Err no they dont. Usually they spam/bot trojans that will do the following:

Write to windows/system32, the registry, etc to hide itself and make itself install again on reboot. Blocked usually as a limited access user.

Open up listening ports for remote commands. Limited users can't do this, unless an admin has given them lax firewall settings.

Register dll's. Nope. Limited users can;t do this either.

Again, its not so hard to realize that most exploits dont work against restricted users. Its not a panacea for security but it helps a whole hell of a lot. The same way you shouldnt run as root all the time, you shouldnt run as admin all the time on windows.

Re:Microsoft Recommends..

[mysticgoat]

I'd rather kick in the nuts the guy who takes advantage of these 'exploits'. They cease to be exploits when there are none willing to exploit them.

So you think that upgrading to Human version 2.0 is the answer? I don't think any of us have the wetware to support that. I think we're stuck with the current ugly bags of mostly water for at least a few more years.

Re:Microsoft Recommends..

[955301]

"Word" Isn't a word processor. It's a platform which includes scripting support. All scripting platforms can be used for less that noble purposes.

Ever heard of buffer overflow attached in browsers from Javascript embedded in html?

Re:Microsoft Recommends..

[mysticgoat]

...how on earth can someone code so sloppily that a WORD PROCESSOR has a serious security exploit?!

Shit happens.

The more significant question is how on earth could an exploit like this manage to get by Quality Assurance for so many years?

The answer is that the Coding For Profit paradigm necessarily imposes a limitation on quality assurance since QA is an expense that must be charged against profits.

A viable workaround is to Code For Free under one of the open source licenses where you can nurture a community of bug-hunters and developers who provide good quality assurance for free. You generate your profits from other aspects of the software business, such as service. IBM and Redhat are doing pretty well with this approach. Until recently I would have mentioned Novell here too, but now there's some doubt about whether Novell will survive what might prove to have been a fatal error.

Wake up little SUSE! The movie wasn't so hot.... but I digress.

I expect that in the next few weeks Microsoft will offer as a workaround a free plug-in that will convert all documents to its new ECMA approved standard. MS will point to Novell as an alternate supplier (therefore avoiding immediate monopolistic legal hassles). MS will point out that MS Office 2007 will be immune to this exploit, so all businesses really need to do is to install the free plug-in and begin migrating their documents to the new format. Which will be supported by Novell's version of OpenOffice, btw, no sneaky deals here, huh?

Re:Microsoft Recommends..

[ergo98]

Again, its not so hard to realize that most exploits don't work against restricted users.

Most current exploits don't work against restricted users simply because so many people run as admins that it's easier to just expect full rights.

There is absolutely no reason why an exploit needs full privileges, though. You don't need admin rights to add something to your own startup items, or to update the normal.dot, or to open and modify files that you have the right to modify, or to download and run .NET applications (side-by-side dlls! No need for registration, not that there was a need with classic dlls either) or to go out to a botnet command website for commands (do trojans actually listen on ports anymore? Now that almost everyone is behind NAT, it seems that it's the norm now for the trojan to actively go out itself, usually to an IRC site, but just as easily it could use nicely allowed by the corporate firewall HTTP).

Re:Microsoft Recommends..

[Overly Critical Guy]

No, I didn't:

Yes, you absolutely did. There are no exploits running around in the wild affecting Macs. You can't cite a single real-world example. Not a single one.

What you conveniently leave out when you cited the long-ago debunked Mac mini hack is that the Mac was previously configured to give anyone an account who requested one, including full SSH access to poke around. Even the readers at Digg tore this one apart. Hardly the typical situation.

None of them are zero-day exploits?

Absolutely correct. None of them are being exploited at all.

Checking one of the UNIX utility vulnerabilities (because these are the only ones that we know when they were discovered) the perl vulnerability was discovered in December 2005.

And yet nobody's exploiting it, because OS X's security prevents access. Next.

With that perl vulnerability, and probably others in the list, it was discovered in 2005 and Apple only get around to releasing a patch now.

Which should tell you just how "urgent" it was to fix something that wasn't really a problem in the first place.

Look at the list above from Apple; you would have had to screen e-mail for HTML, new fonts, turn off your wireless card, not use any Windows shares, not go to any links to web pages given in e-mails, not go to any suspect web pages, etc, etc.

Lies, lies, and more lies. 100% false in every way imaginable.

The only difference is that Apple don't post security bulletins giving people warning, that might damage sales.

Uh, they do post security bulletins.

Have fun having a false sense of security though.

Ah, the old "false sense of security" canard, despite the fact THERE IS NOT A SINGLE EXPLOIT RUNNING IN THE WILD THAT IS INTRUDING ON A SINGLE MAC. You can't cite a single one. Go for it.

Do you have any other skewed, sliced-and-diced "facts" you want to post that I can debunk? Any articles you want to cite without revealing the full situation behind them? Clearly, you have some chip on your shoulder against Macs, but your shortcomings don't change the fact that there is not a single trojan or virus running the wild for Macs. Not one.

Next.

Re:Microsoft Recommends..

[Overly Critical Guy]

If I understand you right you are saying OS X is secure because the rm-my-mac-mini competition wasn't realistic.

Absolutely correct. You cited a "hacking" incident without revealing that participants were given full local access! Compare that to a magic Word attachment in Outlook completely owning your computer just by double-clicking it. Clearly, you're in full damage control mode right now on Slashdot.

First off I only referenced it to show the GP that exploits for these vulnerabilities do exist in the wild, and had been in the hands of hackers for months. Something which he thought I "made up on the spot".

On the contrary. You referenced it to present a skewed image of Mac security, conveniently leaving out that the Mac provided accounts for anyone on request along with full SSH access. Basically, you have to go through a lot of work to make a Mac hackable.

You just need to accept that you got owned on this point. Have fun rejecting any and all Word attachments you receive from any and all contacts in Outlook.

Re:Microsoft Recommends..

[Anonymous Coward]

Cool and then somebody writes a little toos for opening and autosaving files in OpenOffice - Migration worries over - No more MS documents on our systems.... I can't wait. This was so much easier than our previous migration plan :o)

Re:Microsoft Recommends..

[Anonymous Coward]

Holy crap, are you actually linking to a "hack" that provided every participant with full local access including SSH capability to defend a Microsoft Word attachment suddenly owning your computer in Outlook just by opening it?

What, did you just randomly Google for "Mac hack" and posted the first result you found without doing any research behind it? The community debunked gwerdna (Andrew G) and his claims long ago. You can hack anything in 30 minutes if you give people local accounts with full SSH rights. That doesn't have anything to do with this new zero-day Word exploit that doesn't require any local access to own your machine.

Re:Microsoft Recommends..

[pdbaby]

So you'd think, but according to Microsoft, the .doc format is the actual in-memory representation of a word document. They just deserialise from disk & it's loaded.
I'm guessing Office 2007 isn't vulnerable because it just reads the .doc format instead of using it internally (that it doesn't use the same markup internally is evident - Office 2007 messed up a few .doc documents I have lying around).

Re:Microsoft Recommends..

[DeepZenPill]

limited accounts (like every Vista system) will be largely unaffected.

Alright, so all 5 Vista users are safe, what about the rest of us?

Re:Microsoft Recommends..

[kestasjk]

I doubt anyone is really this stupid, you must be a troll, but what the hell..

Yes, you absolutely did. There are no exploits running around in the wild affecting Macs. You can't cite a single real-world example. Not a single one.

"running around in the wild"? An exploit is a piece of code which can be used to exploit a vulnerability. One thing that the rm-my-mac-mini competition showed is that exploits have been written for undisclosed OS X vulnerabilities. If no exploits existed how could OS X's security have been breached, and the Mac Mini's files deleted? Q.E.D.; exploits do exist for OS X.

Absolutely correct. None of them are being exploited at all.

As I showed above exploits have been written for OS X. What you are saying is that the only time exploits have ever been used against OS X was in the rm-my-mac-mini competition. The hackers that look for security holes in Apple's software, and don't disclose the holes, never exploit the holes they find; they just do it in case rm-my-mac-mini competitions come up.

And yet nobody's exploiting it, because OS X's security prevents access. Next.

What about the Safari vulnerability that allows you to remotely execute code? What about the Webkit vulnerability, or the AirPort vulnerability, or the Windows share vulnerability? OS X seems to allow access more than prevent it.

Which should tell you just how "urgent" it was to fix something that wasn't really a problem in the first place.

So holes like anyone being able to get complete access to your machine simply by you connecting to someone wirelessly, or looking at a malicious webpage, or accessing a malicious share or folder, aren't urgent to you? If not then I should say that there's a difference between being secure, and simply not valuing your security.

Lies, lies, and more lies. 100% false in every way imaginable.

But I'm citing Apple's own list of patches. Do you believe Apple's security is so flawless that the only explanation for their list of critical security holes is that they're lying?

Ah, the old "false sense of security" canard, despite the fact THERE IS NOT A SINGLE EXPLOIT RUNNING IN THE WILD THAT IS INTRUDING ON A SINGLE MAC. You can't cite a single one. Go for it.

See above; rm-my-mac-mini couldn't have happened without an exploit. If you're wondering why I keep referring to rm-my-mac-mini it's because hackers or script kiddies with OS X exploits generally don't make a habit of letting everyone know what they've been up to. rm-my-mac-mini is a source which I can cite which conclusively shows that exploits have been written for OS X vulnerabilities. (PS Writing in caps doesn't make people ignore the fact that your (only) argument has already been addressed)

The argument you seem to be stumbling towards is "OS X has practically no market share, so no piece of malicious software written for it can be mass distributed effectively, therefore OS X is secure."
Luckily for you barely anyone owns a Mac. By the same logic I could say "MS-DOS 6.22 is a perfectly secure, robust OS; there's not a single exploit being used against it".


By the way, have you noticed the recent MySpace worm that's being spread with Quicktime? Quicktime is just about the only piece of Apple software that a large number of people use to process data directly from the web, and sure enough hackers find a way to exploit it.

Re:Microsoft Recommends..

[aminorex]

You must be reading version 1.1 of the advisory, which editted out the material quoted in the article. See the revision history at the bottom of the advisory page.

This is, of course, a wonderful example of how one can expect Microsoft to serve it's own interests, against the interests of it's users.

Re:Microsoft Recommends..

[kestasjk]

Basically, you have to go through a lot of work to make a Mac hackable.

From here on I will quote only Apple, as you don't seem to believe anything that doesn't come from Apple.

Impact: Attackers on the wireless network may cause arbitrary code execution

Impact: Visiting a malicious web site may lead to arbitrary code execution

Impact: Uncompressing a file with gunzip may lead to an application crash or arbitrary code execution

Impact: Viewing maliciously-crafted font files may lead to arbitrary code execution

Impact: Using PPPoE on an untrusted local network may lead to arbitrary code execution

Impact: Processing maliciously-crafted email messages with ClamAV may lead to arbitrary code execution

The last one isn't part of OS X, but then again MS Word isn't part of Windows. I haven't included local exploits, because I know you don't believe in them or something..

Re:Microsoft Recommends..

[Arkaic]

"It can't be triggered automatically, and limited accounts (like every Vista system) will be largely unaffected. " Its a good thing Vista is in such widespread usage now.

Re:Microsoft Recommends..

[volpe]

Why don't just use latex?

You're confused. Condoms work on an entirely different kind of virus.

Re:Microsoft Recommends..

[lahvak]

And if you think Word's too complex and shouldn't be doing that much work, you know where to find notepad (or vi), but good luck making professional documents;

Well, I wouldn't be using notepad (it's a total abomination), but a good text editor such as emacs or vim can make editing a TeX document easy and extremely fast. As for professional documents, a good TeX macro package or format (it is debatable whether LaTeX fits this description) will produce documents with much better typography and general look then Word.

It is true that I have seen Word documents that were fairly decent, and I know several people who can produce solid looking documents with Word, however, the amount of stuff they had to learn to do that definitely exceeds what I had to learn to produce better documents with LaTeX or ConTeXt. And with a good editor, I can type TeX faster than Word.

I believe that in the future we will see a TeX like formating engine behind a wysisyg like frontend, something like LyX but more user friendly, possibly with instant communication with the backend. Possibly with the backend running remotely on a server - one thing that is painful about LyX is the amount of crap you have to install with it. If all that was left on a server somewhere and user would just have the frontend on their computer, LyX wouldn't be so bad (of course besides the fact that it uses LaTeX as the default TeX format).

Re:Microsoft Recommends..

[lahvak]

I don't use a word processor, I use LaTeX, which seems to have much better layout rules than any version of Word I have seen. The document I am working on is around 200 pages. Compiling it (including invoking gnuplot to draw a load of graphs, pulling in a few code files and syntax highlighting them, constructing an index and bibliography, and making sure all cross-references are correct) takes 7 seconds of wall time on my current laptop, and most of that is time spent waiting for I/O.

Since the original topic of this discussion was security vulnerabilities, let me note this: I hope you realize that in order to run gnuplot, makeindex, bibtex and who knows what else directly from LaTeX, which is what you seem to be doing based on your description (unless you use some sort of makefile based solution), you must most certainly have \write18 enabled on your TeX installation, which is a major security hole. It gives TeX a shell access, and can execute any code embedded in a tex file or hidden in a package or a cls file.

Don't get me wrong, I love TeX, use TeX for all my document processing needs, and wouldn't touch Word with a 15.5 ft pole, and have \write18 enabled on all my TeX installations, because it just make things so much easier. I just wanted to point out that as far as security goes, maybe we shouldn't be so smug when comparing to Word. Quality of output, sure, easiness and speed of document creation, definitely, in these areas we win without breaking a sweat, but we do have our own security problems.

By the way, the smalltalk based system you are talking about sure sounds interesting.

Re:Microsoft Recommends..

[Drooling Iguana]

Is it Y-2K compatible?

Re:Microsoft Recommends..

[Anonymous Coward]

I'd just like to point out that the person responsible for the La in LaTeX (Leslie Lamport) works for Microsoft. You'd think they'd just ask him to fix things.

Of course it's Microsoft Research and not the office group, but whatever... it's not like he's published anything recently.

Re:Microsoft Recommends..

[TheRaven64]

unless you use some sort of makefile based solution)

I do use a Makefile. Actually, I use a horrendously complicated set of recursive Makefiles. Each chapter is in a separate directory, and has a Makefile if it has other dependencies. The root Makefile does 'make depend' in each chapter directory which contains a Makefile(or in a single chapter if I set an environment variable and do 'make chapter' or 'make view-chapter'). Gnuplot, bibtex and makeindex are all run from the root Makefile. I now have a standard environment configured which I copy when I begin a new project. I then write the outline in OmniOutliner (which is really great for that kind of thing), and run a simple AppleScript (available from my web site, if you're interested) which creates the chapter directories and .tex files complete with chapters, sections, subsections and notes (I have a \note command defined in my custom document classes which prints the note prefixed by 'Note:' in blue and underlined when I compile a draft, and hides it when I compile a final version).

One of the things I really like about LaTeX is that I can use all the tools like Subversion that I use for code.

I think we can be slightly smug when it comes to security, because it is not normal to email TeX documents. You typically compile the TeX to PDF and send that. The only people I ever get TeX from are collaborators who I know well, and usually then I just get diffs which are small enough to audit before compiling. Of course, a rogue package could potentially hurt...

My original post, however, was not talking about security, but about speed. It was a reply to the person who complained that layout took too long in Word already, without re-writing it in a 'safe' language.

The Smalltalk implementation is indeed interesting, and is made possible by the fact that Smalltalk is a (the?) proper OO language, and handles boxing and unboxing properly. Even pixels are objects in Smalltalk, and this is cheap enough that people have written video CODECs in it that invoke methods on the pixels. Because it has proper boxing and unboxing support, this is actually very cheap.

Re:Microsoft Recommends..

[Theaetetus]

See above; rm-my-mac-mini couldn't have happened without an exploit. If you're wondering why I keep referring to rm-my-mac-mini it's because hackers or script kiddies with OS X exploits generally don't make a habit of letting everyone know what they've been up to. rm-my-mac-mini is a source which I can cite which conclusively shows that exploits have been written for OS X vulnerabilities.

Well, yes and no. The rm-my-mac contest proved that a local user can change a locally hosted website, utilizing a privilege escalation exploit in Apache.

This is drastically different from a standard OSX install, where Apache isn't running, remote users can't access the machine (remote access is disabled), and most people don't put their user/pass up on a website.

Also, at no point was the machine rm'd. It did have its index.html page changed, though. The GP's point still stands: there are no OSX exploits out there that don't require the user to provide a vector. That doesn't mean that I can't write a script with "sudo rm -rf /*", wrap it in a .app, and email it out to everyone I know. I certainly can, and they can run it, put in their admin password, and wipe their drive. But there's no vector for spreading it without causing every single user to manually install it, run it, and upgrade it's privileges. All rm-my-mac proved was that social engineering still works against OSX (provide a local account and remote access to someone, and they can do malicious things. Don't do that, and they can't... unless you're running Windows)

Re:Microsoft Recommends..

[dreamlax]

You can disable the write18 command in a lot, if not all of TeX implementations though. This is different to a security exploit in Word which you cannot avoid or disable. write18 is not a security hole, it is a feature that requires attention in regards to security. A security hole is a way to bypass the security put in place.

Re:Microsoft Recommends..

[tepples]

Write to windows/system32, the registry, etc to hide itself and make itself install again on reboot. Blocked usually as a limited access user.

Not if the trojan writes to HKEY_CURRENT_USER instead of HKEY_LOCAL_MACHINE. Enough keys in HKLM have a counterpart in the parallel HKCU hive, and while only the Administrators group can ordinarily write to HKLM, the lowest privilege user in a typical installation of Windows typically has full write access to HKCU.

Open up listening ports for remote commands. Limited users can't do this, unless an admin has given them lax firewall settings.

Many common firewall settings allow outgoing connections on ports 80 and 443. So the botnet operator sets up a supernode listening on port 80 (disguised as "WebServices.exe" or the like) on some compromised PC on a cable line, and all the trojans connect to it.

Again, its not so hard to realize that most exploits dont work against restricted users.

By "restricted user" or "limited user", do you refer to the level below what is called "power user" in Windows 2000 Professional, or do you mean something even lower that I have not had the experience of seeing?

Re:Microsoft Recommends..

[Anonymous Coward]

Recursive make considered harmful.

Re:Microsoft Recommends..

[lahvak]

My original post, however, was not talking about security, but about speed. It was a reply to the person who complained that layout took too long in Word already, without re-writing it in a 'safe' language.

True. I actually agreed with your post, and was reacting to other posts in this discussion, that plainly stated that to avoid security vulnerabilities, one should just switch to LaTeX.

Re:Microsoft Recommends..

[kestasjk]

And the Webkit vulnerability that allowed a malicious webpage the ability to execute code?

Re:Microsoft Recommends..

[Overly Critical Guy]

I doubt anyone is really this stupid, you must be a troll, but what the hell..

Standard procedure for someone who has a weak position is to start with the name-calling.

"running around in the wild"? An exploit is a piece of code which can be used to exploit a vulnerability.

I know that. You have yet to cite an example of a running piece of code out in the wild. Since you appear to be unfamiliar with standard security terminology, "out in the wild" means an actual trojan or worm making the rounds via a security vulnerability. For instance, the MS.Blaster worm that rebooted two-thirds of the world's computers, or the SQL Server worm that took out entire enterprise networks.

One thing that the rm-my-mac-mini competition showed is that exploits have been written for undisclosed OS X vulnerabilities.

No, it didn't. Exploits would be running code out in the wild taking advantage of some remote security vulnerability. As you repeatedly ignore since it decimates your point, the competition provided full local accounts to anyone on request.

If no exploits existed how could OS X's security have been breached, and the Mac Mini's files deleted? Q.E.D.; exploits do exist for OS X.

Once again, you're purposely confusing alleged security flaws with exploits--actual trojan running around, you know, exploiting something. There are none, and you still haven't cited any. Next.

As I showed above exploits have been written for OS X.

And as already stated, the competition was debunked. Clearly you just grabbed the first result you found off of Google.

What you are saying is that the only time exploits have ever been used against OS X was in the rm-my-mac-mini competition.

Exactly. Care to cite an actual real-world incident of an exploit allowing hackers into a Mac out in the wild? You can't. The hard (for you) truth is that there are no OS X viruses or trojans. The UNIX security inherent to the system and the lack of default open ports makes it much more difficult, unlike the Windows world based on Win32, which dates back to the single-user DOS days and was grafted onto the NT codebase like an artificial tumor.

The hackers that look for security holes in Apple's software, and don't disclose the holes, never exploit the holes they find; they just do it in case rm-my-mac-mini competitions come up.

I see--not only are there mysterious, unnamed hackers whose minds you've read, they don't exploit any holes they find. They just sit around silently (again, you somehow know about them, perhaps through a Vulcan mind meld?) until someone sets up a competition where they have full local access with SSH. Mac users must be quaking in their boots! To think, we could be using PCs where we would have to worry about Word attachments taking over our systems (d'oh, the flaw also exists in Word for Mac), rebooting RPC exploits, the neverending series of security flaws coming from IE, and other staples of Microsoft engineering.

What about the Safari vulnerability that allows you to remotely execute code?

The one you completely made up?

What about the Webkit vulnerability

The one that allows malformed HTML to access a deallocated object, crashing the machine, which was quickly patched? Meanwhile, Internet Explorer 7 is vulnerable to flaws disclosed back in 2004!

or the AirPort vulnerability

The one that only affected first-generation AirPort cards in scanning mode that haven't been sold since 2003? As usual, when you tear apart the layers of your argument, the roaches scatter.

So holes like anyone being able to get complete access to your machine simply by you connecting

Re:Microsoft Recommends..

[Overly Critical Guy]

You mean crash your browser, which was quickly patched. What's the problem?

All software has bugs. All software will have security flaws. Microsoft handed the keys to hackers through things like RPC, ActiveX, Internet Explorer, and so forth. Given full local access to a system, including yours no matter what it's running, I could eventually find a way to own it. Hell, I could just reboot and run a bootdisk with MS-DOS and an NTFS driver. The point is that what separates secure systems over insecure systems is how well they stop these things from being exploited in running code propagating out in the wild. OS X is built on a UNIX security model and didn't have a single-user, pre-Internet API like Win32 grafted onto it.

Even if flaws are found, as they will be found in any system, they don't actually spread anywhere on OS X. People yawn, Apple releases a patch, case closed. Microsoft will take weeks to patch this massively damaging zero-day Word exploit that you're obviously in defensive mode over. Hell, there are flaws in Internet Explorer that are years old. IE7 is vulnerable to crap from 2004!

Christ, have fun screening all your email 'lest you receive attachments from someone you trust that turns out to be infected.

Re:Microsoft Recommends..

[Overly Critical Guy]

Careful, the shrapnel flying from the decimation of his argument might hit you in the face.

Pwned.

Re:Microsoft Recommends..

[Anonymous Coward]

haha. you got pwned over the false hack competition you kept referring to, and now you're pointing to some HTML crash bug that already got patched, unlike this zero-day Word flaw. see you in line for a macbook pro

Re:Microsoft Recommends..

[kestasjk]

Since I wasn't even using this obscurity argument, all I can do is throw up my arms at your bizarre strawman attack.

I'll use your only argument that OS X is secure (which I've already addressed over, and over), and replace "OS X" with "MS-DOS 6.22".

Cite a single "remote vulnerability exploit in the wild" against MS-DOS 6.22. You can't, go ahead, I dare you. With Windows I have to worry about hackers writing remote exploits, but with MS-DOS 6.22 none exist at all. MS-DOS 6.22 is therefore more secure than Windows NT 5.x.

Also my house is more secure than The National Museum of Fine Art in Sweden. Number of Rembrants stolen from The National Museum of Fine Art, Sweden: 1, number of Rembrants stolen from my house: 0.
If you question my logic here I will repeat the same argument in a long drawn out form with some National Museum of Fine Art FUD, and some sentences in caps-lock, until you give up and leave me with my false sense of security.


By the way, cite a remote exploit for Windows XP SP2.. It's called an inbound firewall, and any OS with one, which isn't being used as a server, can't have a remote exploit in the sense you require. This makes the number of remote exploits an absurd metric for desktop computer security. What about number of vulnerabilities / number of users? Who do you think would have the largest ratio out of Apple and Microsoft given this more sensible metric?

Re:Microsoft Recommends..

[peetm]

Wordpad, notepad, ... vi!

Re:Microsoft Recommends..

[Overly Critical Guy]

I'll use your only argument that OS X is secure (which I've already addressed over, and over), and replace "OS X" with "MS-DOS 6.22".

Which, of course, would be a strawman, given that OS X isn't MS-DOS 6.22.

Cite a single "remote vulnerability exploit in the wild" against MS-DOS 6.22. You can't, go ahead, I dare you. With Windows I have to worry about hackers writing remote exploits, but with MS-DOS 6.22 none exist at all. MS-DOS 6.22 is therefore more secure than Windows NT 5.x.

This argument is so incredibly stupid, because MS-DOS 6.22 is a dead operating system that hasn't been in use for over 10 years, while Mac OS X represents at least 15% of the world's computers with 18 million OS X users and growing, according to IDC. That's a very large segment of the population that you claim is vulnerable yet sees no viruses or trojans, even with no antivirus software and a firewall off by default. You are really getting desperate now.

By the way, cite a remote exploit for Windows XP SP2.

IE flaw puts Windowss XP SP2 at risk
Windows Metafile Format vulnerability
XP SP2 Firewall bug
More Internet Explorer vulnerabilities that bypass SP2 security features
Hell, just do a Google search for "XP SP2 remote exploit," because I could go on and on and on here. It's pointless.

It's called an inbound firewall, and any OS with one, which isn't being used as a server, can't have a remote exploit in the sense you require.

What a stupid claim. A firewall means nothing if there's another vector of attack. For instance, a flaw in WMF or a zero-day exploit in Microsoft Word that owns your system just by opening a file.

This makes the number of remote exploits an absurd metric for desktop computer security. What about number of vulnerabilities / number of users? Who do you think would have the largest ratio out of Apple and Microsoft given this more sensible metric?

Well, according to the numbers, that would be Microsoft. But you're wrong in claiming exploits are an absurd metric (amusingly, after you spent so many posts focusing on them). The fact remains that OS X's inherent security model stops any security flaws from being exploited remotely and spreading to other users through the Internet.

I notice you ignored all other points I raised. I acknowledge your lack of counterarguments, and I suspect that next time, you'll do better research before you begin citing poor examples for your claims.

Next.

Re:Microsoft Recommends..

[gad_zuki!]

Im not saying you can't write a user-space trojan, Im saying no one does. I'm also saying that to use advancing hiding techniques (loading/registering as a dll, replacing dlls in system32, io streams, driver/kernal hijacking, etc) you would need to have admin access. Without advanced hiding malware is much more easily caught by scanners and removed on the first attempt.

The poster upstream more or less laughed at how lua is a vista concept. Not so. Its as old as NT, at least in the windows world, and even today is a great detterment against malware. LUA practices along with scanners and patching goes a long way. Hell, if I had to take one of thsoe things away Id give away my virus scanner and run as LUA with all the patches. It would be more secure.

Looks like a long work day tomorrow

[filesiteguy]

If I can't even open my friends' documents then what am I - as a manager to do?

Oh, wait - I don't do anything anyway and my life revolves around Excel.

Nevermind.

Re:Looks like a long work day tomorrow

[bogaboga]

Oh sure? So it looks like a long work day for you tomorrow? I have some work for you.

Please begin putting together a schema for OpenOffice.org using the recently GPLed Java framework. I am very certain that this will keep you busy enough.

By the way, am I alone in thinking that it would be a good idea to have OpenOffice.org re-written in the Java language? The Java license is now very appealing.

Re:Looks like a long work day tomorrow

[thrillseeker]

By the way, am I alone in thinking that it would be a good idea to have OpenOffice.org re-written in the Java language?

very alone ...

Re:Looks like a long work day tomorrow

[nine-times]

I have two words for you: As long as you PowerPoint, you're all set.

Re:Looks like a long work day tomorrow

[Anonymous Coward]

That's a lot more than two words. Perhaps you should have used the preview button?

Re:Looks like a long work day tomorrow

[daft_one]

Yeah, I agree. It should be rewritten in Python!

Re:Looks like a long work day tomorrow

[bluefoxlucid]

I recommend a full rewrite in C. OOo is C++ and Java, and it shows. It's an ugly code base and it's slow and bloated. It gave us one great thing: Michael Meeks dropped load time 40-70% by rewriting the linker and adding new types of non-standard hash tables, as well as sorting of both standard (without violating standards) and non-standard hash tables and elf symbols.

But you know why he did it? Because the way C++ symbols work, they flood us with namespace and class symbols, tons of vague linkage, and all kinds of cruft; around 90% of the time OOo spends loading is due to having to process data that's only there from C++, which a similar feature-for-feature C re-implementation wouldn't have (like name spaces and classes and virtual tables and such). Usually you can rewrite and get around having such things; it makes code a little more complex sometimes though, and I do recommend some form of object oriented language when you really need CLASS INHERITANCE.

Re:Looks like a long work day tomorrow

[aibrahim]

> I have two words for you: As long as you PowerPoint, you're all set.

>> That's a lot more than two words. Perhaps you should have used the preview button?

Never attended a presentation ? Thats actually a Powerpoint users notion of two words.

Re:Looks like a long work day tomorrow

[newt0311]

I personally think that half of the openoffice devs should go to lyx and work on perfecting it while the other half go to tex4ht so that I can make odt files out of latex sources and who ever has a problem with this can go and develop a super format conversion kit to convert any document format to any other document format. Now... bring on the aplause.

Re:Looks like a long work day tomorrow

[arifirefox]

how will that help its security?

Re:Looks like a long work day tomorrow

[An Onerous Coward]

/me blinks.

I'm suddenly feeling very confused.

Re:Looks like a long work day tomorrow

[gnarvaez]

Yes, it would. For the Mac there is Neooffice (neooffice.org). While it is not as fast as using the Microsoft products, it is fast enough and does not seem to crash as often (I hate using word with document that have more than a couple of footnotes, tables, etc. Almost always Office will crash... been through all the checks on fonts, etc. Office is a crappy product. What I would like to see is an update of FrameMaker for the Mac, come on Adobe, you know it is a good product if only you were to maintain it properly and give it a current GUI... or release it to the open software community).

Re:Looks like a long work day tomorrow

[Jello B.]

Obviously. This is Slashdot, not IRC.

Re:Looks like a long work day tomorrow

[mollymoo]

If I can't even open my friends' documents then what am I - as a manager to do?

I don't know where you got your MBA, but the low-hanging fruit is there to be picked - in simple terms, you need to synergize new communications opportunities by leveraging existing facilities. Incentivize your staff to maximally capitalize on the benefits of an approach which unifies the output of global arboreal facilities, exsting team-member dexterity and some pens.

Re:Looks like a long work day tomorrow

[poopie]

By the way, am I alone in thinking that it would be a good idea to have OpenOffice.org re-written in the Java language? The Java license is now very appealing.

Umm... I think some out of work java programmers are with you. Oh, and I think you've got the support of memory chip manufacturers and makers of quad core CPUs.

Re:Looks like a long work day tomorrow

[Mr. McGibby]

When I first read your post, I seriously thought you were joking. Then I realized you weren't. You're crazy. Rewrite an app the size of OO.org (in any language)? Are you serious?

Then maybe OO.org devs should learn how to write proper C++ code. It doesn't have to be that way. And if you think that CLASS INHERITANCE is the only reason to use C++, then you don't know C++.

Re:Looks like a long work day tomorrow

[Anonymous Coward]

From what I've seen, Powerpoint's notion of two words is about six slides. Information content's about the same.

Re:Looks like a long work day tomorrow

[gwait]

Oh, and have a couple work on a spell checker..

Re:Looks like a long work day tomorrow

[gwait]

Hear hear!

I went from using Framemaker on Sun OS to office on win 95. I remember when templates actually did something, and paragraph numbering actually worked..

Perhaps if we all changed

Re:Looks like a long work day tomorrow

[gwait]

Arg - stupid laptop mouse pad!

Perhaps if we all changed our sig to this?

"There is no truth to the rumour that Adobe is going to Open Source the Framemaker product line."

Re:Looks like a long work day tomorrow

[1u3hr]

What I would like to see is an update of FrameMaker for the Mac, come on Adobe, you know it is a good product if only you were to maintain it properly and give it a current GUI... or release it to the open software community).

Adobe is letting FrameMaker and PageMaker gradually become obsolete, incorporating features that they think are saleable into ID. Before long they'll stop updating FM and PM at all. But they'll never release the code. Adobe has bought up lots of innovative apps to gain a feature they wanted for their flagship products, and taken them off the market. Eg, Ares font applications about 10 years ago.

Re:Looks like a long work day tomorrow

[ZeroExistenZ]

I recommend a full rewrite in C

Hey! Why not in Assembly? It's more efficient!

I highly doubt going back to an older generation of programming languages is going to improve things, new generations of programming languages are there to solve problems the previous generation didn't address or failed to do properly. (otherwise there wasn't any need to develop new languages, is there?)

I'm having a hard time to believe you are serious as you're suggesting OOP design is flawed and is causing overhead; You write Object Oriented code so your code is more easily managable. The compiler should take care of all the optimazation, we have processing power now, so why not take advantage of that in a development environment? C or C++ are languages btw, you have several compilers that process C or C++ code, so are you saying a compiler you've used or think MS has used is flawed or the language in itself?

it makes code a little more complex sometimes though

How is that going to make the system more secure and less exploitable but making it even harder to overlook?

Re:Looks like a long work day tomorrow

[splutty]

*BBZZT* *BZZZT* *BBBZZZT* *BZT* *BZZZT* *BZT* BINGO!

(For those of you unfamiliar with managereze bullshit bingo, the term is self explanatory)

Splut.

ps. You forgot the involvement of reprocessed organic material, harvested from ecologically acceptable farms.

Re:Looks like a long work day tomorrow

[Cederic]

Hmm. 3.5k java jobs available in the uk at the moment on Jobserve.com alone.

Even allowing for duplicates, that's enough for a significant percentage of the UK java programming workforce to switch jobs with immediate effect. Which would free up further Java programming jobs.

Out of work Java programmers may be harder to find than you think.

Re:Looks like a long work day tomorrow

[gnarvaez]

I know that Adobe won't let go of it and that it is already obsolete for the most part (heck, when I was using it daily it had a cumbersome HI. Yet, I feel there is no other application that has the stability to deal with large (I mean "LARGE") documents... say API guides of 500 or so pages (I know that is small be some measures, but either is impossible for Office to handle... and document linking? Please! It never worked well and was more frustrating than doing the renumbering by hand (page numbers, ok, but figures, footnotes, etc. What a pain).

For one job, where I had an incompetent and micromanaging supervisor who insisted on us using Office, I started keeping track of hours spent recovering from Office crashes. Today I am considering how to write a dissertation and I am either contemplating putting together a PC with Windows NT to run FrameMaker (or better yet, using Virtual PC on my Mac), or getting a faster Mac and using OpenOffice. I expect the doc to be 350 or so pages long and to have many footnotes, citations, etc. No way am I trusting it to Office (I have looked at other apps like Nisus, but while they are more dependable than Word, they are not as reliable as I would like).

Hummm... wonder if I should do it like in the old days, with VI and LaTex?

Re:Looks like a long work day tomorrow

[itz2000]

I don't know where you got your MBA

Where... or... how, and if his professor enjoyed it :P

Re:Looks like a long work day tomorrow

[WillAdams]

Rather than VI and LaTeX, you may find LyX more comfortable. It's more word-processor-like, but w/ an interesting and innovative concept, it's a ``What You See Is What You Mean'' _Document_ Processor.

http://www.lyx.org/

Then, once it's done you can export to LaTeX and hack at things to your heart's content.

William

Re:Looks like a long work day tomorrow

[HerbieStone]

By the way, am I alone in thinking that it would be a good idea to have OpenOffice.org re-written in the Java language?

Again? www.thinkfree.com allready has an Office in all Java. The thing is so fast, that you'd think it's written in plain C.

Re:Looks like a long work day tomorrow

[stokessd]

I wrote my masters in Framemaker (5.1?) and battled file corruption issues (Mac system 7-8 timeframe). I did my PhD in Latex and it was WAY WAY WAY better and the document was twice as long.

Spend a half a day and get familiar with how it works, and what it can do for you. you'll be much happier in the long run.

Sheldon

Re:Looks like a long work day tomorrow

[bluefoxlucid]

Drepper's paper explains why it takes so damn long to work through C++ symbols. This is a limitation of the ABI, not of the compiler's ability to optimize or the programmer's ability to code.

C++ also makes a lot of indirect addressing crap, due to having to bounce through classes and virtual tables; this is about 5 times slower than immediate addressing.

Meeks' paper shows exactly where most of the load time for OOo is spent; this happens to be a lot of symbol look-up through C++ symbols. Practical example of the stuff in Drepper's paper.

C++ brings things like namespaces (useful, but they do cause the longer symbol look-up time) and operator overloading (evil, causes code to be obfuscated massively; most so-so programmers like not having to type myMatrix.Add(otherMatrix), while many experienced programmers seem to hate having to check the types on 'x' and 'y' when they see x=x+y somewhere). Still, you don't exactly need these; namespaces change your functions from gtk_window_do_crap() to gtk::window.do_crap(), and allow you to tell the compiler that if you don't specify anything, gtk:: is assumed.

Re:Looks like a long work day tomorrow

[bluefoxlucid]

Mmm... depends. The programmer affects security mainly. The language affects the types of flaws possible; these can be minimized.

OOo is mostly C++ and some Java intermixed, so feasibly we won't see much of a difference. Then again, apply Stack Smash Protection; and use PaX or flip on SELinux exec* memory permissions; and you'll see most of the C/C++ specific security vulnerabilities vanish automatically. The other stuff (i.e. you run untrusted scripts without asking; you have an SQL back-end and don't use prepare/bind and have injections; etc) is not tied to the C language.

Re:Looks like a long work day tomorrow

[bluefoxlucid]

New generations of programming languages solve problems and introduce new ones. Look at C# and Java for example; I've written a paper addressing what the virtual machines they run on cause for security concerns and ideas on how to fix it.

I prefer Objective-C for an object oriented language over C++; it too has its flaws, for example its class member calls are all indirect like in C++ (much slower addressing mode, this involves multiple reads and destroys branch prediction). But that's just me.

Re:Looks like a long work day tomorrow

[Mr. McGibby]

This is a limitation of the ABI, not of the compiler's ability to optimize or the programmer's ability to code.

And nothing to do C++. The first paragraph of the second paper you mention points this out. Windows/C++ fine, Linux/C++ slow. Sounds like a Linux/Binary format problem. Sounds like Windows fixed it. Perhaps the Linux/G++/whoever screwed this up, folks should fix this.

operator overloading (evil, ...)

I was taking seriously up to this point. You really seem to know your stuff. I appreciate the papers. They're quite well written. But if you think that operator overloading causes causes code to be obfuscated massively then you know NOTHING about operator overloading and how it is used in practice. Any language feature can be used for evil.

So, I appreciate the information, but what exactly is your point? Because I don't see how it has anything to do with C++.

business

[Feyr]

not open .doc ? are they fucking insane? 90% of the business is just that messing with .doc

guess we know who to thanks when productivity drops to zero in the coming days!

Re:business

[Anonymous Coward]

Boy am I glad I'm an Electrical Engineer. I haven't seen a .doc file since college. Everything I load up is in pdf.

Re:business

[Anonymous Coward]

No there not insane, As usual it is the article submitter/poor slashdot editing at fault here. MS didn't recommend not opening or saving word documents. They recommended not opening "UNSOLICITED" word documents received in email. It is amazing how one word makes the difference between and informative article and complete FUD as this one it.

Re:business

[John Hasler]

> not open .doc ? are they fucking insane? 90% of the business is just that
> messing with .doc

> guess we know who to thanks when productivity drops to zero in the coming
> days!

Or rises toward infinity as people find that they have time to do actual work.

Not quite...

[Anonymous Coward]

The summary is slightly misleading.

In order for this attack to be carried out, a user must first open a malicious Word file attached to an e-mail or otherwise provided to them by an attacker.

As a best practice, users should always exercise extreme caution when opening unsolicited attachments from both known and unknown sources.

In other words, make sure you know what you're opening. But still - wtf. This is very serious.

On a lighter note, the unofficial workaround is to use vi. MS says Emacs too complicated and competes with Windows.

Lets see...

[jlarocco]

So let me get this straight... For the time being the only safe Word files are new files that other people don't need to open?

But hey, you saved a ton of money on retraining costs.

Re:Lets see...

[ceoyoyo]

Microsoft doesn't recommend using .doc as a data exchange format anyway. They say to use .pdf for that. .doc files aren't reliably readable enough. ;)

Re:Lets see...

[dwater]

Any reference for that? I'd love to be able to quote such to ... well, anyone, really.

Re:Lets see...

[ceoyoyo]

I wish I did. Somebody posted a link in a response to a Slashdot story years ago. I believe it was after the release of yet another Word version that broke backwards compatibility. In response to criticism MS pointed to a deeply buried white paper or help document or tech note or something that stated .doc was not intended for exchanging documents and recommended using PDF instead.

I did a quick search and couldn't find anything.

Re:Lets see...

[acq3]

Slashdot has really gone downhill when this gets mod'ed as Insightful, funny maybe, but Insightful?!?!

Re:Lets see...

[ceoyoyo]

Judging by your ID# you really should have been around long enough to remember when MS actually said that. Maybe not though. I wish I had the link, but MS did actually say .doc was not designed for document exchange. They were under fire at the time for breaking backwards compatibility of the format YET AGAIN, but that just illustrates the truth of the statement.

Re:Lets see...

[Red Alastor]

I thought you were referring to the MS Office / OpenOffice comparison document Microsoft released a while back. It was released as a pdf and argued that .doc was a perfect exchange format since everybody could read it. According to its meta-data, it was also made on a Mac with Quark Xpress :)

Re:Lets see...

[ceoyoyo]

MS has never been particularly consistent. Or careful about their metadata.

Re:Lets see...

[Anonymous Coward]

So being around for a long time means reading every anti-MS tirade on the site? Hardly.

By the way, have you heard what the wacky Bill Gates said about 640K? I can't believe the man would be that short-sighted.

Now might be a good time to try ...

[Anonymous Coward]

http://docs.google.com/

Re:Now might be a good time to try ...

[Anonymous Coward]

Yes! Great idea! Just trust all of your internal documents to a random third party company with no privacy guarantees. But hey, at least they've made a vague "Do no evil" promise!!1!

Re:Now might be a good time to try ...

[Anonymous Coward]

Random? Your definition of that word is fairly interesting.

Re:Now might be a good time to try ...

[pdbaby]

Isn't it more likely the sales patter for Office 2007 will become of course, if you were using our latest version...?
Not that I'm suggesting Microsoft engineered it, mind... but it might not be as bad for them as seems initially

Re:Now might be a good time to try ...

[Rick17JJ]

They could also use OpenOffice instead, at least temporarily. There are also other free alternatives such as using Abiword to view Word documents that they receive from customers. Abiword a well known alternative for Linux computers, but I see they also have Windows and Mac versions too. I also see that Word 97 isn't on their list of affected software so perhaps businesses could also consider just use their old copies of Office 97 to view incoming documents for the next few weeks (or did they just neglect to mention any version of Word that old).

At home, I use OpenOffice running under Ubuntu Linux, so I should still be able to view Word documents safely.

Re:Now might be a good time to try ...

[rvw]

Download the patch here!

This service is offered to you by Novell, your new Microsoft partner!

Re:Now might be a good time to try ...

[eugene_roux]

Yes! Great idea! Just trust all of your internal documents to a random third party company with no privacy guarantees.

Yes, your Sarcasm is well placed. Yet another reason not to use Microsoft products!

But hey, at least they've made a vague "Do no evil" promise!!1!

Oh, you meant Google, not Microsoft! Ah, well, this -- at least -- is something you'll have to wait for hell to freeze over before you get from Microsoft...

Re:Now might be a good time to try ...

[mgblst]

And this is different to Microsoft how?

Re:Now might be a good time to try ...

[jacksonj04]

I must say, despite my initial doubts, the Ribbon is amazingly useful. All the options I need are never more than a click or two away, no longer buried in Format>Paragraph>Advanced>Options>Advanced>Custom or something similar.

That said, wonder why Word 2007 doesn't suffer from this. Have MS actually tightened up some security?

Re:Now might be a good time to try ...

[Dekortage]

I met a college student last year who writes all of her papers in Adobe Photoshop. She just sets up 300dpi pages and types all the text into text boxes. That way she could make pretty photographic backgrounds. And there are NO security issues!

I didn't realize it then, but she is obviously a genius.

Re:Now might be a good time to try ...

[bogado]

Well you trust a software company that continues to have the world record of security holes, virus and all kinds of spyware, why shouldn't you trust a random person? It seems to me that most enterprises are already trusting random people not to explore their computers.... :-)

Re:Now might be a good time to try ...

[Anonymous Coward]

If you're using Word/Windows combo I can't see the difference :)

Re:Now might be a good time to try ...

[mysticgoat]

Let me fix that for you:

Yes! Great idea! Just trust all of your internal documents to a different random third party company with no privacy guarantees.

Re:Now might be a good time to try ...

[ConceptJunkie]

Microsoft has made no promise about not doing evil, and they've shown it on a daily basis for 15 years.

Of course, I would actually be happier if Microsoft would make a promise to "Do no stupid."

Re:Now might be a good time to try ...

[berzerke]

...I also see that Word 97 isn't on their list of affected software so perhaps businesses could also consider just use their old copies of Office 97...

M$'s list doesn't give versions that are not vulnerable, so I wonder if 97 really is immune, or simply not tested (or M$ won't admit it is vulnerable). Ditto for 2007.

Re:Now might be a good time to try ...

[Headcase88]

Look into Clippy's eyes! Are you implying it is not trustworthy?

Re:Now might be a good time to try ...

[PriceIke]

He could have been talking about Intuit, but then we know Intuit has no "Do No Evil" maxim anywhere near its corporate mission statement.

Re:Now might be a good time to try ...

[jpetts]

1993 quote from Jim Allchin from current Iowa antitrust trial: "This really isn't that hard. If you're going to kill someone, there isn't much reason to get all worked up about it and angry. You just pull the trigger. Any discussions beforehand are a waste of time. We need to smile at Novell while we pull the trigger. There are thousands of documents that show the truth. Microsoft is not just a tough competitor. It's not just an aggressive competitor. It is a competitor who is willing to break the law and commit anticompetitive acts in order to destroy competition."

Re:Now might be a good time to try ...

[Organized Konfusion]

obviously trying to avoid plagiarism detection.

what about OO.org?

[no reason to be here]

Could the problem be avoided by opening the any .doc files with OO.org? i'm assuming that the exploit will only work if the file is actually opened with word, so it would stand to reason that opening it with some other application would be safe. can anyone tell me why i'm wrong?

Re:what about OO.org?

[sowth]

I would assume since OO does not have the same code base, it will probably not be affected. However, it does not mean OO doesn't have exploits of its own. It all depends on how well coded and audited OO is.

Haiku looks like an interesting project. How well does it work so far?

Re:what about OO.org?

[Anonymous Coward]

We tried, only to see that the documents were mangled and OO crashed often. Then someone told me it's always like that, so you should be fine.

Re:what about OO.org?

[Anonymous Coward]

How about Abiword or any other Word Processor? I got rid of OO.o awhile back as I did not use it. I certainly do not use MS Office. I use Abiword to open .doc file from someone using MSWord. Otherwise, all the stuff I write on a Windows machine is done in Notepad, and if it needs formatting usually I just throw some HTML and CSS into it. On my Linux box I am now using Vi. Very nice little program.

Yes after the question in the first sentence this post just meandered off into the wild.

Re:what about OO.org?

[OglinTatas]

You sir, are spot on. Back when macro viruses were rampant, when word 6 would unexpectedly corrupt word documents and make them "unreadable," it was wordperfect to the rescue. The file conversion would strip any macro viruses, and would ignore formatting that it couldn't understand, compromised/corrupted files could be rescued, (and re-saved in word 6 format to begin the process again, because officially we are a microsoft only shop)

Good Advice

[antonyb]

Microsoft suggests that users 'not open or save Word files,' even from trusted sources."

Good general advice, really. They should put that on the Office packaging, like on a packet of cigarettes.

ant

Re:Good Advice

[trparky]

ZING!

ODT

[Jrabbit05]

I think we found a reason.

A Smarter Choice

[Anonymous Coward]

Microsoft suggests that users 'not open or save Word files,' even from trusted sources. Unless you're using OpenOffice.

Work-Around = OpenOffice

[Tsu Dho Nimh]

In the meantime, download and use OpenOffice

Re:Work-Around = OpenOffice

[arifirefox]

i would want to make sure before you even try to open .doc files from openoffice. after all, this affects office for mac too

Re:Work-Around = OpenOffice

[dch24]

Cue "Mac is not more secure than Windows" in 3... 2... 1...

Re:Work-Around = OpenOffice

[rthille]

how about cue the, "you should never run Microsoft software on any platform" comments...

Re:Work-Around = OpenOffice

[GogglesPisano]

If capable word processor is all you need (and you don't feel like installing an entire office suite just to get it), I'd also suggest AbiWord.

There is a lot to like about AbiWord: it's open-source, cross-platform, lightweight, feature-rich, stable, and able to read and write MS Word documents.

Re:Work-Around = OpenOffice

[Tsu Dho Nimh]

OpenOffice has a totally different way of opening files ... it isn't going to be suceptible because it has nothing for the virus to attack. MSOffice, on the other hand, has hooks all over the operating system to be exploited.

"Word"?

[Mihai Cartoaje]

"Word" is a generic term in word processing. WordStar existed before Microsoft Word.

Re:"Word"?

[Anonymous Coward]

It isn't generic anymore.
Bitch

Re:"Word"?

[jpardey]

I could be wrong, but I don't think WordStar invented words either...

It's pretty common now to call Microsoft Word just Word.

Re:"Word"?

[joshetc]

For some reason I dont think Microsoft cares about exploits in WordStar or any other non-Microsoft Word application.

Re:"Word"?

[flyingfsck]

'In the beginning was the Word and the Word was good...'. MS obviously invented all words. MS also invented all Windows, including the X variety which is clearly based on the X-box, which must be running both X and Windows.

Re:"Word"?

[1u3hr]

There was Ami Pro Word, the forst Windows word processor (before MS Word). And the .doc suffix used to be generic too, usually plain text.

Re:"Word"?

[1u3hr]

It's pretty common now to call Microsoft Word just Word.

On the one hand, it's less of a mouthful. On the other, like "Windows", ".doc", "Office" it continues the practice of making generic terms imply Microsoft products, and anything else is just an imitation. But still MS products all default to creating absurdly long folder names like "c:\Program files\Microsoft Office\..."; though they're not alone there. I override these as much as I'm allowed to use 8-letter max, no spaces; 8.3 letters should be enough for any filename....

Not open or save?

[Aardpig]

So, Microsoft are basically telling us to stop using Word? Sounds like great advice to me -- cheers, Bill!

Re:Not open or save?

[Anonymous Coward]

And to call the local FBI if we think we've been infected. Wonder if they say that on all security advisories, and if the FBI groans every time.

It's like comedy, only funnier

[Dracos]

First, an exploit in IE causes MS to tell us to type in links manually rather than click them.

Now MS advises everyone not to use their flagship bloatware? There simply aren't enough R's, O's, F's and L's in the fabric of space-time to express how funny this is.

Or they're just scraping the bottom of the barrel for ideas on how to get people to upgrade to Vista and Office 2007.

Re:It's like comedy, only funnier

[Anonymous Coward]

You talk with a listhp, don't you?

Re:It's like comedy, only funnier

[ewl1217]

I think not...

#!/bin/bash
rofl=1
until [ "$rofl" = "0" ]
do
echo "ROFL"
done

Re:It's like comedy, only funnier

[newt0311]

HHaaahhh you nub at bash. Every bash geek would know to use yes... Now I can out ROFL you... in C!!!

Re:It's like comedy, only funnier

[ewl1217]

Using yes would just be too simple...

Re:It's like comedy, only funnier

[poopdeville]

This wouldn't make the "ROFL"s come out quickly enough. What we need is a distributed "ROFL" making system. I propose that someone make a Word document that 1. Exploits the vulnerability. 2. Emails everyone in the user's Outlook db a copy of the document. 3. Executes a suitable equivalent of: #include main() { while 1 printf "ROFL"; } }

Re:It's like comedy, only funnier

[poopdeville]

#include
main() {
    while 1 {
        printf "ROFL";
    }
}
would be even better.

Re:It's like comedy, only funnier

[ewl1217]

Well, I was doing some bash scripting at the time... no need to over-analyze it...

Re:It's like comedy, only funnier

[poopdeville]

Oh come on. I was just suggesting that making a distributed "ROFL" printing system using the ROFL-inducing vulnerability would be funny. In a geek way. I could have just said "using a functional equivalent of your code" to get the point across too.

Re:It's like comedy, only funnier

[Anonymous Coward]

Hmm...first you set rofl to an integer, then you test for string equality (instead of [ $rofl -eq 0 ]). It works, but it's bad programming. Remind me to never hire you as a programmer.

Ha!

[Anonymous Coward]

I _TOLD_ ya the only version of word worth owning is 97. NOW do you believe me???

Is it April 1st already?

[beavis88]

Seriously, please be a joke. This shit is going to be hell to try and explain to everyone at work, and then un-explain later, without totally fucking up all the investment in getting them to not infect their machines with all manner of crap. :(

zero day

[Anonymous Coward]

What the heck does zero-day mean?

Re:zero day

[kcbanner]

It means an exploit there is no patch for! Its the zeroth day that they know about it :P

Re:zero day

[DebateG]

Zero day: At the time the details of the exploit are published (or the patch is released), there already is an active exploit being circulated. I guess if you don't know exactly when the exploit was released it's a technically "less than or equal to zero-day" exploit, but that doesn't sound as sexy.

Re:zero day

[LarsG]

It means that there is a working exploit out there in the wild, which is using a vulnerability that was previously unknown to the security community / the software maker. That is, there was zero days warning.

Re:zero day

[nine-times]

A simple search would turn up the answer. It basically means there's no warning, and no time to prepare. The exploit's existence is made public the same day as the flaw's existence.

Re:zero day

[TrappedByMyself]

It's one of those 'cool' phrases that nerds like to use. Kinda like 'attack vector'.

Re:zero day

[Anonymous Coward]

Sounds like buzzword cooked up by IT security vendors. An exploit that they didn't know about and have no fix/workaround for as yet - probably 99.999% of nasty shit out there - "five-nine," get it? ;-) And they accuse MS and others for obscuring euphemism.

Re:zero day

[pestario]

Zero day [wikipedia.org]: At the time the details of the exploit are published (or the patch is released), there already is an active exploit being circulated. I guess if you don't know exactly when the exploit was released it's a technically "less than or equal to zero-day" exploit, but that doesn't sound as sexy.
Wow... wikipedia really let itself go since the last time I checked...

Re:So many versions, same bug

[jibjibjib]

Making the Ribbon, and then congratulating themselves on how cool it looks, and then making advertisements with people with dinosaur heads.

Misleading summary

[2cv]

The Security Advisory doesn't say not to open any DOC files. It says:

Do not open or save Word files that you receive from un-trusted or that are received unexpected from trusted sources. This vulnerability could be exploited when a user opens a file.

I wish sometimes I could mod article summaries...

2cv

Re:Misleading summary

[ad0gg]

Welcome to slashdot.

Re:Misleading summary

[fermion]

Since I have no idea what this exploit is, or how it is transmitted, simply that it does something bad if I open a document, the article summary seems to be better advice than the article. When one does not understand a vector or virus, the best thing to do is to err on the side of caution until the vector and virus is understood. This means that perhaps MS Office documents not originated on the local machine should not be opened for the next couple days. This quarantine, while inconvenient, would probably be useful.

At the end of the day, articles from major outlets will soften the advice so as not to upset the advertisers. It is up to the user to read between the lines and interpret the appropriate course of action. Of course, most will ignore the advice and continue with status quo by, for example, exchanging essentially static data in a dynamic form, thus allowing such problems to exist.

Article Summary is Flamebait

[Somegeek]

Hey, I like to bash Microsoft as much as the next guy, but there is a pretty bad rewrite going on here.

Microsoft DOES NOT suggest that

users 'not open or save Word files,' even from trusted sources."

as stated in the summary.

What they do say is :

Do not open or save Word files that you receive from un-trusted or that are received unexpected from trusted sources.

That is nothing more than standard precautions that one should take anyway. If you aren't expecting an attachment, don't open it. If you are expecting it, and it is from a trusted source, go ahead.

Nothing to see here, move along...

Re:Article Summary is Flamebait

[Kludge]

That is nothing more than standard precautions that one should take anyway. If you aren't expecting an attachment, don't open it. If you are expecting it, and it is from a trusted source, go ahead.

Really? I get documents that I'm not expecting all the time. I never have any fears opening Latex documents from anybody. You Microsoft folks sure have funny security.

Re:Article Summary is Flamebait

[Perseid]

Yeah, they taught me in school that latex was a good way to guard from viruses.

Re:Article Summary is Flamebait

[Anonymous Coward]

Consider this: Joe Schmo who sits in the cubicle next to me is not so security conscious. Not knowing about (or perhaps not taking seriously) this advisory, he opens an infected Word file then proceeds to open, edit, and save a report he and I have been jointly working on for the last week. Popping his head around the corner, he asks if I can take a quick look at his revisions and let him know what I think. Sure thing. Now I'm infected too, even though I've been careful not to open unknown or unexpected documents I've received. Or I can take the xenophobic approach and not open anything until the patch comes out. Fun times explaining that one to my manager. So while the summary is a blatant rewrite, I think it's easy to imagine examples where the spirit holds true.

While I'm not certain this exploit can self-propagate this way (or at all), being warned not to save a Word doc makes me think it is a real possibility.

Re:Article Summary is Flamebait

[JoshJ]

Congrats- that's the best one-line response I've seen on Slashdot in a long time.

Re:Article Summary is Flamebait

[poopdeville]

Eh, typesetting unsolicited LaTeX documents is a security risk. TeX is a Turing complete language, and the tex engine has read/write access to the filesystem. It just happens to be an unlikely vector for attack.

Re:Article Summary is Flamebait

[radtea]

If you aren't expecting an attachment, don't open it. If you are expecting it, and it is from a trusted source, go ahead.

This is not a useful guideline. I am a businessperson. I sometimes get Word documents sent to me by people looking for jobs. I got a resume' last week this way, with a cover letter from a guy saying, "I saw your website and think you have cool technology, I'm looking for a sales position, etc." There are other examples as well. I have a large, loosely coupled network, and am apt to get odd doc files for a variety of reasons coming out of the blue.

So for me, at least, "unexpected" doc files are the norm. Opening none of them is not an option. Checking all of them is more than my time is worth--it would be like going back to the '80's, when every time you sent an important e-mail you made a phone call to see if got through ok.

The reasonable alternative is to open them with OpenOffice, which is what I do, and frankly what Microsoft would be advising if they cared about their customers. There isn't even a profit motive to not recommend OpenOffice, because Word is so enormously superior to OpenOffice that no one will ever switch to it after a few weeks of painful security-driven transition.

Re:Article Summary is Flamebait

[Woldry]

like going back to the '80's, when every time you sent an important e-mail you made a phone call to see if got through ok.

You mean like my current PHB does in 2006, and no doubt will continue to do in 2007 and beyond? (She also e-mails me to tell me to check my voicemail when she leaves me voicemail. Sometimes she leaves sticky notes attached to my inbox on my desk to tell me to check my e-mail, too.)

Re:Article Summary is Flamebait

[goombah99]

I'm sure there are Latex Trojans too. Used 'em myself.

Re:Article Summary is Flamebait

[Anonymous Coward]

I never have any fears opening Latex documents from anybody.

Well, sure. Latex is easy because you probably have met each of the other 6 users of Latex personally....

Re:Article Summary is Flamebait

[watzinaneihm]

well, atleast the rewrite is not from the submitter... it came straight from the article...

Re:Article Summary is Flamebait

[Anonymous Coward]

> I'm sure there are Latex Trojans too. Used 'em myself. Yes, but you're posting on slashdot - so you probably used them as water balloons ;-)

Comment removed

[account_deleted]

Comment removed based on user account deletion

reasons to switch

[Treates2]

dont open, read or write word documents, sit there at the computer screen, we own your soul!

Blurb slightly-FUD

[Repton]

The actual quote from the Microsoft page is:

Do not open or save Word files that you receive from un-trusted sources or that you receive unexpectedly from trusted sources. This vulnerability could be exploited when a user opens a specially crafted Word file.

If you send an email to Fred saying "Can you send me xxxx", and Fred replies, saying "Here it is", you can probably safely open the attachment. You should just exercise caution when Fred sends you an email out of the blue saying "Hey, read this would you?".

Re:Blurb slightly-FUD

[Elixon]

> If you send an email to Fred saying "Can you send me xxxx", and Fred replies, saying "Here it is",
> you can probably safely open the attachment. You should just exercise caution when Fred sends you
> an email out of the blue saying "Hey, read this would you?".

Should Fred open my message "Can you send me xxxx" if it was not preceded by Fred's message "Can you send me your 'Can you send me xxxx'"?

Or should I pick up the phone to inform the Fred that I'm sending the "Can you send me xxxx" message to make him sure he can safely open my message and reply with "Here it is"?

Evolution cannot be stopped (even if going in circles ;-)

Re:Blurb slightly-FUD

[JasonBee]

What was so obscene about that request that you had to replace it with X's?

JB

Re:Blurb slightly-FUD

[Anonymous Coward]

An email is not a word document now, is it? You're obviously not very intelligent. Hey, check out this Interesting.Doc file!!!

Re:Blurb slightly-FUD

[Iriestx]

If you send an email to Fred saying "Can you send me xxxx", and Fred replies, saying "Here it is", you can probably safely open the attachment. You should just exercise caution when Fred sends you an email out of the blue saying "Hey, read this would you?".

That doesn't keep Fred from sending you a infected file. Fred gets an email of an unsolicited .doc. Fred runs the attachment. Fred infects his word files. You call Fred asking for for a specific file. Fred sends you said file, infected hours ago from his attachment. It's not unsolicited. It's from a trusted source. That doesn't mean it's not infected.

Re:Blurb slightly-FUD

[sharkey]

But, I send you this file to ask you advice!

Re:Blurb slightly-FUD

[jibjibjib]

no, just post on /. saying you are sending fred xxx, and hopefully he will read it.

btw, can I have some XXX too?

Re:Blurb slightly-FUD

[initialE]

Outlook has a feature that uses Word to compose emails. Just by receiving an email, you could be pwned.

Re:Blurb slightly-FUD

[Keeper]

Word composed mail is not sent in the Word format. If it did, Slashdot would collapse under the weight of people falling over themselves to complain about it ...

Re:Blurb slightly-FUD

[Anonymous Coward]

typo? porn is signified by xxx's not 4.

Re:Blurb slightly-FUD

[ivanjager]

Only if you trust Fred... If Fred sends you a cool screensaver (and you know it's actually from Fred) would you run it? Do you trust Fred to not have opened any Word document you wouldn't have opened? If he did, it could have modified all the ones he wrote himself, or the ones receieved expectedly from a trusted source.

Basically, if you don't trust Fred enough to give him your password, he isn't a trusted source.

Here's a workaround

[spiritraveller]

Microsoft suggests that users 'not open or save Word files,' even from trusted sources.

Uhhhh, right.

How about just opening those files in openoffice, mmmmmkay?

Bah, typical bullshit non-edited craptastic blurb

[beavis88]

And typical me not reading TF security advisory before posting. The actual wording from Microsoft is:

Do not open or save Word files that you receive from un-trusted sources or that you receive unexpectedly from trusted sources.

The Evolution of Microsoft Office

[Elixon]

> 'not open or save Word files,'
Do they call it "The Evolution of Microsoft Office"?

> To help you understand more about the merits of Microsoft Office 2003, we are preparing the new series of FREE training courses for you.
TRAINING COURSE - RULE#1: Don't open or save Word files!

> It's time for an evolution! Act now to take the Microsoft Office 2003 Training Courses and get rid of your current backward office!
TRAINING COURSE - RULE#2: Since you cannot open/save your documents... get rid of your current backward Office!

More Office tips and tricks: http://www.microsoft.com/hk/office/officetips/defa ult.mspx

Re:So many versions, same bug

[symbolset]

You forgot to mention the Vista sound. The put tons of effort into that.

Just in Time For...

[ookiiniku]

Thats right, College finals! Just what we need when all those papers are due. "Sorry Prof. I can't write that research paper for you, nor can you open it safely... Guess I should get an A."

Re:Just in Time For...

[Anonymous Coward]

Its called Notepad. There is also Google Docs and Spreadsheets.

I LOVE YOU!!!!!!

[Anonymous Coward]

The Link Vic! Don't Click The Link!!!!

But we wuz too late...the Reverend...saw the light!

Obvious Response

[cheese-cube]

And thus begins the torrent of Microsoft mocking posts. Get your mod-points out and set them to +5 Funny because the laughs are only just beginning. *sigh*

Re:Obvious Response

[TheJasper]

You're damn tootin. That's why I read /.

Re:Obvious Response

[Loco Moped]

And thus begins the torrent of Microsoft mocking posts...

Your post implies that somehow such mocking is not a justified response to Microsoft's continual blundering.

After a while, yes, it does become funny. See the Three Stooges, for example.

Re:Obvious Response

[Harry Coin]

Jesus Christ, did you just start reading /. yesterday? If /. has one core philosophy, it's Fuck Microsoft always has been, always will be.

I get tired of the humor around here too, that's why I read all the comments and then bitch about them later. It's a very efficient system.

Microsoft Marketing...

[SirKron]

This is a new spin to upgrade to their new Office 2007 product line.

text is where it's at!

[PenguinBoyDave]

I'm seeing this as a HUGE opportunity to start the text document revolution. You can get really creative with characters and create some really romantic notes with text. Chicks would surely go nuts for a guy who could create character-based graphics with text!

Problems with reportage?

[symbolset]

EWeek is pretty good about reportage and editing. If their article says (and it does):

There are no pre-patch workarounds available. Microsoft suggests that users "not open or save Word files," even from trusted sources.

Then I believe they got that answer when they asked. Perhaps their phone reps are more forthright than their website. Imagine that.

Not opening Word files seems like a good idea. Microsoft IP's in them, and that's icky.

Re:Problems with reportage?

[bunions]

Gee, let me think. Believe EWeek, or believe that Microsoft said to stop opening word documents until further notice?

Hmmmm....

I'm gonna go with "misquote."

Re:Problems with reportage?

[Anonymous Coward]

Quoth the SA

Recommendation: Do not open or save Word files that you receive from un-trusted or that are received unexpected from trusted sources. This vulnerability could be exploited when a user opens a file.

Re:Problems with reportage?

[bunions]

sure. and the EWeek article says

> Microsoft suggests that users "not open or save Word files," even from trusted sources.

I'm sure you see how these are, in fact, different statements.

Re:Problems with reportage?

[2cv]

Yeah, and Dewey won the '48 election because the Chicago (Daily) Tribune said so...

Have no fear! The patch is here!

[8127972]

Download it using the links below:

http://www.openoffice.org/
http://www.thinkfree.com/

Zero-day?

[mclearn]

I thought the definition of "zero-day" was an exploit issued on the same day as a patch or fix. eg. a new patch is sent out, but contains ANOTHER security hole. Someone issues a new exploit based on said hole on the same day is said to have issued a zero-day exploit. This sounds like someone picking up on the word "zero-day" and making it sound more dramatic than it really is.

Re:Zero-day?

[dbarclay10]

This use of the phrase "zero-day" is not new; it's commonly used in circles where security plays an important role to refer to a publicly-known/available vulnerability/exploit for which 0 days of notice was given to the vendor.

While Microsoft and Oracle and friends would have you believe that the IT community at large is irresponsible and we just go ahead and use bullhorns to broadcast our latest vulnerability find, it's actually quite unusual to come across a real vulnerability (which this appears to be) for which the vendor was given no notice nor opportunity to fix the issue in a reasonable (read: weeks, not months) timeframe.

The term may have at one point been used to refer to example exploit code which was provided on the same day as the vendor's fix, but that certainly isn't the common usage today.

HTH

Re:Zero-day?

[Tharkban]

I thought Zero-day refered to the first day that a vulnerability is publicly available. Start counting up from there. I've seen it used in every possible way though. Sometimes I gather people are refering to the day the patch was issued. Wikipedia doesn't really clear it up http://en.wikipedia.org/wiki/Zero_day

Re:Zero-day?

[Provocateur]

picking up on the word "zero-day" and making it sound more dramatic than it really is

Quoting Jack Handey:
I think there should be something in science called the "reindeer effect." I don't know what it would be, but I think it'd be good to hear someone say, "Gentlemen, what we have here is a terrifying example of the reindeer effect."

OMG OFFICE SUCKS

[darkzeroman]

Why dont you just RTFA? It clearly says "Recommendation: Do not open or save Word files that you receive from un-trusted or that are received unexpected from trusted sources." But instead of reading, people are just to busy to type "OMG OFFICE SUCKS(etc)" or "OPENOFFICE is the BEST" Sidenote: Currently using 2007 Standard Trial, and liking it.

Re:omg office sucks

[Anonymous Coward]

I recommend prying of the caps lock key on your keyboard, your the only person I see using it.

Re:OMG OFFICE SUCKS

[ewl1217]

You must be new here.

Re:OMG OFFICE SUCKS

[smchris]

You and the five people above you are surely so right. What's the big deal? Somebody sends you an email, just call him up and say, "Did you really mean to send me an email?" Where's the inconvenience in that?

Re:omg office sucks

[alshithead]

I recommend remedial English. "your the only person I see using it." Maybe you mean "you're" as in "you are"? Don't fucking criticize someone else's usage unless you can do better.

Re:OMG OFFICE SUCKS

[jesdynf]

This is an excellent point.

Having read the comments, the article, and the linked document from TechNet, I slowly and deliberately type the following:

OMG OFFICE SUCKS.

Re:OMG OFFICE SUCKS

[Iriestx]

The person you are requesting from can be infected and not know it. That person can then send you the file you requested from their pool of infected files.. Being solicited and from a trusted source doesn't mean the file is clean in this case.

Re:OMG OFFICE SUCKS

[lahvak]

First: there is no reason a virus can't be attached to an email that somebody actually personally sent. Before Outlook worms arrived, that is how most email viruses used to spread. You would open a document somebody sent you, it would infect your computer, and attach itself to all emails you sent after that. At some point of time somebody figured out a way to make a virus actually mail stuff automatically. That's an email worm, but a simple virus does not have to do that.

Second: number of people are required to read emails and documents from customers, and in many cases in such situation, you simply cannot call to people and ask them if they really meant to send you a document.

Third: imagine you need to send a document to a large number of people on a company mailing list. You probably wouldn't want every single of the 200 or 300 people calling you and asking if you really sent them an email.

Oh, great!

[Marsala]

Yet ANOTHER feature Word has that OpenOffice doesn't. :(

Re:Oh, great!

[Anonymous Coward]

DAMN YOU LINUX!! if I were on a MS machine i wouldn't have to work for 12 days.
12 DAYS!!

Re:Oh, great!

[Anonymous Coward]

Oh gee, we're so funny, aren't we? Well, who's going to target the Open-so-called-Office if no-one uses it anyway?

Spam/Virus firewalls

[Twillerror]

I'm not to worried about this because most users are aware of attachment exploits like this.

I'm sure the major spam firewalls will also have signatures in a relatively short period of time. If my email spam/virus firewall will stop this I'm fine.

For the home user it is a bit more of an issue. At the same time most people use Yahoo, MSN, Google or some other account that has active scanner that I'm sure will be able to block these in the short run...if not by analyzing the file by analyzing the subject line. Heck, chances are it'll look like spam to my firewall won't let it thru to begin with.

I do wish MS would put out the technical details of this exploit. It sounds like some sort of a buffer overflow. Something tells me it is a graphic insert of some sort, but who knows.

Re:Spam/Virus firewalls

[trwww]

I'm not to worried about this because most users are aware of attachment exploits like this.

Yeah, people like this user know all about things like that.

Eh, What's up(loaded) .DOC?

[Thorrablot]

(Wite apologies to Bugs Bunny)

By now you've seen dozens of postings about using OpenOffice as an alternative until Redmond patches this (One might even suspect this is a marketing ploy to encourage everyone to upgrade to Office 2007, but... naaahhh)

Folks - if there's malicious content - why take *any* chances? Upload the document to Google's Writely.com and be really insulated from malicious code!

Trusted Computing Means?

[BoRegardless]

Sounds like it means Trusted to Be Risky.

Well, I'll just get out my "Trusty" CanOpener application (don't laugh as it works) and use it to open my .doc files on my Mac.

Tell me about it...

[MsGeek]

Really freaking super BAD timing, man. Thanks one hell of a lot, MicroShaft.

And there is a POLICY here where you absolutely, positively, HAVE TO have MS Office and USE IT here at Woodbury University. I was using OO.o on Linux for the longest time and sending things out as PDF to profs, but one of my profs wanted to COMMENT ON MY DOCUMENTS so no using OpenOffice and getting by.

Unfortunately I don't think ANY of my profs are going to accept the "zero-day Word exploit, sorry, no paper for you" excuse.

Re:Tell me about it...

[pyite]

And there is a POLICY here where you absolutely, positively, HAVE TO have MS Office and USE IT here at Woodbury University.

This would seem like an alternate universe to me, coming from Rutgers where, like many other universities, not using Word is the norm and people look at you funny when you don't use TeX or some variation thereof. I can't imagine having to use Word for any real work. It's a pain to just write a simple letter.

Re:Tell me about it...

[alshithead]

So...print a hard copy and hand deliver. They can render their comments using the dreaded RED PEN. If they're not up to that task then they don't deserve the title of "prof". Crediting Heinlein...PhD = piled higher and deeper.

Re:Tell me about it...

[JoshJ]

Uh... OO.org has the ability to save as .doc circa Word 2003. That should be able to get the job done, provided you're not doing anything too fancy (and for term papers, I wouldn't expect you to).

Re:Tell me about it...

[jibjibjib]

It's a pain to just write a simple letter.

Would you like some help?

Re:Tell me about it...

[idugcoal]

MOD PARENT UP! Freakin' Hilarious! Am i the only one who remembers Clippy?

Re:Tell me about it...

[MsGeek]

My Stats prof will not accept paper submissions. It's all about the environment with him. "Paper is wasteful." One of my Psych profs wants to be able to use the comment feature in Word to add their comments. Which leaves one prof who still takes papers on paper. I think this is a trend, unfortunately.

What is the chance that we will see the fix in a..

[Joe The Dragon]

What is the chance that we will see a fix in a week. As next week is the company's scheduled December Patch Tuesday, but there is no word yet from Microsoft on the timing of its fix for Word.

Early Adopters

[Slite01]

Ho! But does it affect Word '97 which my company is currently stuck on? Wait a minute... Maybe my company gets the picture... I mean, if you fail to upgrade for long enough do people give up and quit exploring for exploits for it? Or does it just mean that the software is too antiquated have the same vulnerabilities as today's software? Let this be a lesson to you "Early Adopters". Oh nevermind, I want my Word 2k3 (or soon to be 2k7) with or without it's 0-day flaw.

Re:Early Adopters

[flyingfsck]

I haven't had any new problems with Windows 95 in years and Windows ME is looking better every day... ;)

How do they know if it is Zero Day?

[Anonymous Coward]

Why not -1 day or -2 day or -99 day? They only way they could tell is if they are in cahoots with whoever released the exploit.

Re:Just to be safe..

[symbolset]

disconnect the triprong MS Virus Enabler: http://www.techexcess.net/images/products/600/6ft- power-cord.jpg

What can one say?

[adaminnj]

!!!ROFLMAO!!!

so one gets the heads up until Zer0 Day

Make OO the standard and fork MS.

Community issues patch in record time!

[Anonymous Coward]

Download here.

Main Page

[MBHkewl]

How come MS's front page mentions nothing of the incident? Shouldn't their visitors/customers be alerted? ...

Re:Just to be safe..

[assassinator42]

Good thing I connect via WiFi.

Mature

[Anonymous Coward]

Once you mature professionally, you'll be writing lots of papers and hardly use any of the tools you currently use today - or whatever the replacements are. Then you'll create the PDF files for other to read and reference.

I spend my working hours in outlook, word and excel plus a browser. Then I create PDF v1.6 files so none of the non-Adobe PDF readers can open them. Our lawyers are pansies.

5 years ago, I'd spend those hours in vim, Visual Studio, StarTeam, xxgdb and a few xterms typing 'make'.

Re:Mature

[Anonymous Coward]

Just because you gave up to chase the paper trail doesn't mean the rest of us plan to.

This aughta make FINALS more interesting...

[surfcow]

Dear Professor,

My final project for the semester is attached as a Word document. If you have any problems reading it, please let me know. Me and everyone else in your address book.

Don't have to worry about grading it. By the time you read this, I will have used the root-kit to grade it myself.

Nice porn, by the way! You dog! We'll make this our little secret.

love,
toodles

Re:This aughta make FINALS more interesting...

[alshithead]

You fail! "aughta"? How about "oughta"? Or even better..."ought to".

Re:This aughta make FINALS more interesting...

[Anonymous Coward]

Dear Professor,

My final project for the semester is attached as a Word document. If you have any problems reading it, please let me know. Me and everyone else in your address book.

Dear surfcow,

The syllabus clearly states that all electronically submitted assignments should be presented in PDF or other non-proprietry formats. Please resubmit your assignment.

Love,
Your physics professor

Re:This aughta make FINALS more interesting...

[Anonymous Coward]

Dear surfcow,

The syllabus clearly states that all electronically submitted assignments should be presented in PDF or other non-proprietry formats. Please resubmit your assignment.

Love,
Your physics professor

Yeah, you wish. Many teachers I know would only take a word document. On the other hand if this is for a CS class I guess you would deserve the A for the Hack anyway. Right ;)

Re:This aughta make FINALS more interesting...

[Anonymous Coward]

Yeah, you wish.

I'm a physics TA, and I do require open formats for submitted assignments. Some other TAs around here do, too.

Re:Bah, typical bullshit non-edited craptastic blu

[munrom]

Ah, license to ignore any unexpected memos for the next couple of days, excellent

I advise the same thing

[erroneus]

Except that I have been saying that for years. MS Doc format is an untrustworthy format. It has been known to carry unexpected payloads in the past and there are alternatives which are known to be safer yielding similar if not identical results for most people. (And if someone thinks they actually NEED to have VBA in a word document, I'd have to suggest there's probably a better way to program your way out of the situation you find yourself in. I just haven't been able to think of a good reason to have programming code in a Word document and I haven't seen a good example either. Can anyone offer a reason good enough?

ODT works well... hell, for that matter RTF works well enough for most people.

Re:I advise the same thing

[Shados]

I have a feeling its mostly for integration more than anything. For all practical purpose, Excel, Word, Access, Visio, Power Point, are all one and the same. For the use the big payers make of them, it has to be that way.

So integrating all of them means integrating the features. Obviously its easy to think of a reason to have VBA in Excel, Access and Visio. But you might integrate Excel stuff in Word...

Beyond that, Word also gets used as a kind of RAD tools for forms to fill out, such as an internal test. Though in the current world a quick web app probably would do the job better, it wasn't always that way, and there's probably a lot of legacy code to support, etc.

The second reason is kind of obsolete now, and really should be avoided like plague, but the integration between the different Office products do make sense, so....

Re:I advise the same thing

[StArSkY]

I use VBA in word docs for doing large scale mail merges where I save each merged doc as an indivdual file named with the contents of two merged cells. I re-use this code lots, but it still place it inside the merge template, because it is easier to distribute for people to use.

Re:I advise the same thing

[Ungrounded Lightning]

I just haven't been able to think of a good reason to have programming code in a Word document ...

How about displaying pretty, ever-changing, animated fractals that are rendered on-the-fly in the reader's machine? Try that without an embedded programming language.

B-)

Re:I advise the same thing

[jibjibjib]

Easy... just embed a video file. Word docs are so bloated anyway that no one would notice the difference.

Re:I advise the same thing

[erroneus]

I'm actually intrigued by your response. Tell me more about how you do this? Or maybe you could point me in some directions for examples? What data sources are accessible when doing this mail merge thing? (And after that, I hope to migrate that process to utlize OpenOffice.org using similar methods.) Where I work, we use a somewhat obsolete version of GoldMine and people use the hell out of it. The mail merge functions are used often enough for either emailing or printed mail but uses GMLink which is, at times, a problem. By working with other methods, I am hopeful that it may be possible not just to employ a potentially more usable and trouble-free means by which to do mail merges, but even as a means to use OpenOffice to accomplish those ends which would give FOSS yet another toe in the door at my office. (I already deploy Firefox and "remove" MSIE, I have installed the GiMP for Windows and a notable few have taken to it as well.)

Re:I advise the same thing

[Steve001]

erroneus wrote as part of a post

ODT works well... hell, for that matter RTF works well enough for most people.

I agree that RTF is a very usable format for most writing. It generally provides the formatting that most people actually need (and doesn't have the formatting limitations that basic HTML has), is human readable, and it also has the advantage of keeping the file size small.

Re:I advise the same thing

[pbriand]

Firstly, I would like to state that I do not endorse the use of Microsoft Office, nor do I condemn it. It has it's uses, although personally I feel there are more appropriate applications for home users who need the simple document or spreadsheet.

There are occasions when a company would like to integrate features from their software and/or databases with Microsoft Office, such as report creations, using VBA for dynamically interfacing with their own proprietary information. Such uses definitely have their merits provided the company can be assured that confidential information will in effect remain confidential. While designing your own applications to access, manipulate and display data may ultimately be more secure, Microsoft Office software provides the industry with a means to quickly perform those tasks. In most companies, time = money and the time saved using Word, Excel, etc may outweigh the time required to develop proprietary systems.

Regards,

pbriand

Fair is fair...

[zappepcs]

At least there was a warning rather than 43 unannounced patches next Tuesday, I'll say that much for them. Its a shame that there is no patch yet though. Without saying how detrimental this will be for MS, I'm thinking that now I can't tell people that OOo is just like MS Office but free... now I have to tell them that its probably safer too. Ugggh, the people that want OOo and F/OSS software to be as good as MS Office and OS products really bug me, and this story is exactly why.

Ya, sure, MS is the biggest target, so gets more hacker attention. Just the same, being king of the hill is not easy, and F/OSS software makers should do their best to simply keep doing things well, rather than doing them 'just like MS does' as its not working out so good for Redmond today.

Do everything that 80+% of users want, do it very well, and let the Excel gurus and desktop publishing companies do the things for those other 12% or so. That's the biggest bang for buck right there. That 12% might be the biggest spenders, but they also don't care about the cost, or don't want to retrain or convert etc. ad nauseum.

Not Word 2007?

[Atlantis-Rising]

I take it then, that this vulnurability has been fixed in Word 2007?

Coincidence? I think not!

Re:let me be the first to say

[Anonymous Coward]

mod me troll

Hold on here! Doesn't the moderator know the rules here? If you say "mod me troll", it means that you aren't allowed to moderate the post as "troll." The cute kicking your toe in the dirt and admitting you aren't good enough is supposed to endear the poster to the harshest of moderators.

Mod me off topic.

MOD UP PARENT

[Anonymous Coward]

Good question. What idiot moderated that redundant?

uggh what a spammy site

[Anonymous Coward]

200 words surrounded by hundreds of banners, spamlinks, skyscrapers, sidebars, flash ads, uggh its no wonder even consumers are blocking adverts when sites like that exist

Exercise caution...

[flyingfsck]

How is one supposed to exercise caution when opening a Word document? Do click on it slowly and deliberately, or do you click it carefully after giving the PC a pat on the head...

Re:Exercise caution...

[dch24]

Do not fear, I work for the important security team that just place the extensive documentation on the web site. Please click for the more information.

Re:Exercise caution...

[TardisX]

Caution's a dog. You need to take him for a walk first.

Re:Exercise caution...

[soops1966]

>How is one supposed to exercise caution when opening a Word document? Do click on it slowly and deliberately, or do you click it carefully after giving the PC a pat on the head..

No, click on it a little bit at a time until you can just make out what's inside.

I recommend...

[LoverOfJoy]

sticking with Word 97. It's apparently not affected by this.

Re:I recommend...

[Anpheus]

I've noticed both Notepad and Wordpad are not vulnerable.

I'll just stick with these inferior applications while boasting a smug sense of superiority.

Ha-HA!

Re:I recommend...

[sumdumass]

Lol.. I wasn't aware anyone still used notepad for things other then web development. I guess it still has it uses.

Re:I recommend...

[Skidge]

I've noticed both Notepad and Wordpad are not vulnerable.

Nor is vim! :wq

Re:I recommend...

[mackyrae]

I used to type everything in Notepad and use Courier font and make my teachers think I was using a typewriter. Sometimes I did use a typewriter, but not often. If I needed double space, I'd paste it into Word, but most stuff on my comp was saved as .txt files. I use vi for a lot of my typing and coding now.

Re:I recommend...

[sumdumass]

Ah yes, the typewriter. I remember when I was first allowed to use one in school. It made getting someone else to do my home work for me so much easier. And my grades showed it too.

I like VI (VIM actualy) but i need to work on how to use it better then just a notepad replacement. I had the luxury of watching someone skilled in VI work a while back, I didn't even begin to understand what it is capable of. I've since learned that was just the tip of the iceberg. I don't care who you are, you not going to be able to match the functionality or speed with any alternative word processor I have seen (well, in the windows GUI world anyways).

Re:I recommend...

[mackyrae]

I just started using it a little bit ago. Then one of my friends showed me :vsplit and I went O.O COOL!

Re:I recommend...

[Anonymous Coward]

Emacs is better.

Re:I recommend...

[Steve001]

Anpheus wrote:

I've noticed both Notepad and Wordpad are not vulnerable.

I'll just stick with these inferior applications while boasting a smug sense of superiority.

Ha-HA!

I disagree that Notepad and Wordpad are inferior applications compared to Microsoft (MS) Word. I think that each is better for its intended purposes than MS Word is. I think a better phrase to use for them would be: a more limited application than MS Word.

Rather than MS Word, I use a word processor called Jarte for my writing. It basically adds missing functionality to Wordpad to make it a full word processor and I've been very pleased with it. For simple, straight-forward word processing it is a terrific program. It is also a great text editor too. Also, since it does not have macro capability it is not vulnerable to Word macro viruses even when viewing MS Word files.

Well, DUH!

[Brett Buck]

>Microsoft suggests that users 'not open or save Word
>files,' even from trusted sources."

      Most of us figured that out a long time ago. The REAL question is whether you will be able to tell the difference between file corrupted by this exploit and file corruption that just happens because of all the OTHER profound bugs.

        Brett

uhhhh

[elmCitySlim]

How am I supposed to type my report tonight?

Oh yea, disconnect the internet. Goodbye /. for the rest of the night!

The answer is simply...

[Tatsh]

Don't use Microsoft Office EVER.

Error in article and MS link

[MrLint]

Office for MacOS X has 2 versions: v.X (10.x) and 2004 (11.x)

There is no 'Microsoft Word 2004 v. X for Mac'

ITS A TRAP!

[Anonymous Coward]

Microsoft created this deliberately, to promote sales of Word 2007.

Re:ITS A TRAP!

[somersault]

Hey, our current products are insecure! So buy our latest one! It's better!

Good marketing plan there.

Re:ITS A TRAP!

[johnw]

Hey, our current products are insecure! So buy our latest one! It's better!

Good marketing plan there.

It's always worked in the past. Why change a winning formula?

"good as MS office"

[arifirefox]

you mean feature parity ("we can do 5 billion kinds of tables!") as opposed to being as easy to use or having good performance.

Re:"good as MS office"

[mackyrae]

Since when is OOo hard to use for the usual stuff? The only thing I'm wondering right now is "ooooo automatic bibliography stuff? neat! how does THIS work?"

Re:"good as MS office"

[arifirefox]

Open office does a pretty good job. It's just that we have to be careful when we see a review that compares OOo and Office based on number of features. That leads to a trap. One thing I would like to see is a multi-clipboard. Actually I'm hoping to see it in Firefox...flock has a similar concept.

Re:"good as MS office"

[mackyrae]

On Linux you can fudge a multi-clipboard. Right-click>copy or ctrl+c on one thing, highlight another. Then to paste the first, ctrl+v or right-click>paste, and to paste the second, middle button or both buttons (if two-button mouse).

Re:"good as MS office"

[linuxfanatic1024]

Another answer: Use Glipper on GNOME or Klipper on KDE. They show system tray icons and hold the most recent things you have copied using either method (this is configurable) and let you pick past items.

can you not grasp the headline?

[Anonymous Coward]

ya, it is much better to trust your most secret internal documents to random third party "businessmen" over in whoknowswhereistan after you got *owned*.

Microsoft-successfully extorting money from governments and businesses for a quarter century-and damn proud of it! Never has one company screwed up so much and profitted from it in the history of the world. This is 2006 and people still pay good money for that utterly craptastic zero-warranty rubbish. No wonder the western economy is cruising on credit and trying to outsource reality, the combination of booze and coke at top managerial decision making circles has finally about run the course-straight into the ground. They are running on fumes, inertia and bravado, because it sure isn't based on intelligence.

Re:can you not grasp the headline?

[glesga_kiss]

ya, it is much better to trust your most secret internal documents to random third party "businessmen" over in whoknowswhereistan after you got *owned*

No it isn't. How old are you? Have you ever worked in anything other than McDonalds? Company Confidentiality is essential for running a business. It's also a legal requirement in the case of HR records. Uploading particualar records to Google would breach numerous laws and could get you closed down.

Legal issues aside, it's well known that Google do analysis of their data. Do you really want a bot crawling over your companies secrets? What if your business is something that overlaps with one of Google's products?

Do Google provide an SLA? Do you even know what an SLA is? What if the site's down, do you just send everyone home for the day? What's their privacy policy? Data safeguards? Encryption? Backups? Version control?

The rest of your post is equally nonsensical. What does the warranty provided with Microsoft Word have to do with corporate mismanagement and it's possible effects on the western economy? Next you'll be telling me it was Microsoft that invaded Poland.

Re:can you not grasp the headline?

[RemovableBait]

Your sarcasm detector needs adjustment.

Re:can you not grasp the headline?

[glesga_kiss]

Your sarcasm detector needs adjustment.

Nope, the post I replied to wasn't using sarcasm. Trust me, I'm a Brit; we practically invented sarcasm. Read it again, in it's entirety. The people who modded it "interesting" agreed with me (on it not being a troll/joke at least). It's basically a typical "Microsoft are the cause of the worlds problems" rant.

Re:can you not grasp the headline?

[Tim C]

Nope, the post I replied to wasn't using sarcasm. Trust me, I'm a Brit

Judging from his home page URL, so is Removable Bait...

On the other hand, I tend to agree with you - I don't think the OP was being sarcastic either.

Thanks

[KwKSilver]

For the link to the "Sacred Ribbon." I'd heard a lot about it but never had seen a pic that was big enough to decipher. Looks about like every other freakin toolbar I ever saw, only 2-3 times as bloated. Imagine that. Oh well, to each their own...

we're all going to die....

[cheeseboy001]

Did anyone else read that as "Microsoft Ossues Zero-Day Attack Alert For World"?

Re:we're all going to die....

[DebateG]

That's a pretty scary thought. First they OSsue Lindows, now they're OSsuing the world. Next thing you know, they'll be Officesuing OO.org.

Re:we're all going to die....

[Anonymous Coward]

Did anyone else read that as "Microsoft Ossues Zero-Day Attack Alert For World"?

No, I read it as "Double the killer Word Zero-Day Attack select all".

For once I'm glad

[Allnighterking]

I'm running office 97 on whine.

The problem is...

[dfm3]

...that so many people have a bad habit of composing even a simple text message in Word, then emailing it out as an attachment. We have a number of people who do this at work, despite being repeatedly reminded that they can simply write their message within their email program. It's aggravating to receive an email that simply reads "see attached", then to actually read the 3-sentence message one has to save the .doc file to their computer, fire up word, and open the file, potentially exposing themselves to whatever the newest exploit is.

Re:The problem is...

[NullProg]

...that so many people have a bad habit of composing even a simple text message in Word, then emailing it out as an attachment.

These are what Microsoft refers to as power users :)

Enjoy,

Sure...

[Shawn is an Asshole]

That's why the Windows XP Security Guide is distributed a .doc...

Re:Bah, typical bullshit non-edited craptastic blu

[qzulla]

I didn't get the memo either.

qz

Oh my God!!!!!!

[edwardpickman]

Wait a minute I use Open Office, Never mind.

Perfect.

[LowTolerance]

Just in time for finals!

SLASH! KNOCK OFF THE FUD SUBMISSIONS!

[davidsyes]

I'm probably going to damage my "excellent karma" (at least as shown on my personal page when I log in, but....

JESUS H. CHRIST jumping a barbed wire fence, Slash editors. Who's letting these submissions across the wire? While slash is not a world-class journal or trade rag, it ought tot

As MUCH as I tend to slight microsoft, the fake FUD from submitters is likely to cause more irreparable damage than the few of us who are terse and critical toward microsoft.

Please, take more time, or force your editors to work in teams as "two-person integrity" or SOMEthing. This is getting ridiculous.

C'mon, did microsoft REALLY say, "'not open or save Word files,' even from trusted sources."?

Likely NOT. Y'see, SOME of us can recognize the cute little enclosure of single and double quotes. I didn't at first catch it until I read another comment in this thread. When I went back, I got pissed, feeling the submitter is trying to be wiley and cute. But, for every IT or biz exec who considers Linux based on things in Slashdot (probably more and more a mistake these days), another will point to lame submissions such as the one being shredded now...

But, you know what? I am starting to think some mshaft people (who volunteered for projects, ascended the local ranks, gained trust and leadership positions) INFILTRATED Slashdot and is intentionally posting FUD like this to rile up the readership, get them passing bogus information, and setting them up for discrediting in the workplace. This sounds like rumored infiltrations going on with various Linux development groups, where some Human Trojan screws with projects and releases broken code in apps and distros to stymie and screw with companies trying to earnestly deploy Linux-based solutions or interoperability.

If that is the case, then Slashdot needs better vetting.

Re:SLASH! KNOCK OFF THE FUD SUBMISSIONS!

[AlXtreme]

JESUS H. CHRIST jumping a barbed wire fence, Slash editors. Who's letting these submissions across the wire? While slash is not a world-class journal or trade rag, it ought tot

Welcome, you must be new here!

They actually did say that, but you could claim the slashdot post was misquoted: "Recommendation: Do not open or save Word files that you receive from un-trusted or that are received unexpected from trusted sources. This vulnerability could be exploited when a user opens a file."

I know this is slashdot, but RTFA.

This is what should happen to Wormy Home Computers

[bmo]

This is a response of a complaint that I sent to orange.fr about an infected computer.

Bonjour,

Nous avons bien réceptionné votre mail relatif à la transmission de virus par un de nos abonnés.
Nous vous remercions d'avoir porté ces faits à notre connaissance et vous informons que le nécessaire a été effectué auprès de l'utilisateur fautif : son accès a été résilié ce jour.

Cordialement,
Service Abuse Orange Internet

If only US ISPs did this.

For the non-french-speaking, like me, the Babelfish translation isn't too bad.

--
BMO

[OT]pointless but funny reply to signature

[Beryllium Sphere(tm)]

>What on Earth are Alice and Bob up to that everyone wants to read what they are writing to each other?

http://www.xkcd.com/c177.html

But the POINT is they WON'T stop it.

[Ungrounded Lightning]

I'm sure the major spam firewalls will also have signatures in a relatively short period of time. If my email spam/virus firewall will stop this I'm fine.

And what do you do about the exploits already mailed to you, before the firewall suppliers figure out signatures and put them in place?

And if they don't successfully design signatures to catch ALL exploits of the flaw, what do you do about later stuff that exploits the flaw differently, and arrives in the window before signatures for THAT exploit are developed.

And so on.

Reactive anti-malware firewalls and filters will always have vulnerability windows between exploit and update and will usually have multiple windows per vulnerability - because updates are triggered by exploits and signatures tend to be tuned to exploits rather than flaws.

Flaw-fixing has a window of vulnerability too, but only one (if it's done correctly).

Details missing or, unknown?

[filekutter]

Is this a buffer overflow? Is it insert of code? Or, is it just access? Ummm... since this is just the details of HOW... well, if its used then the code behind the exploit could make more than the infected machine vulnerable, and so, ALL WORD docs could be compromised shortly... it IS possible, until the patch comes out. But, then it won't be available to those pirates so it will spread anyway as the computers they've upgraded become infected... *grin*... tx microsoft. :P

Re:Bah, typical bullshit non-edited craptastic blu

[dwater]

...not sure why files expected from trusted sources can't be infected too.

FUD police

[symbolset]

The quote in the summary was from TFA and was correct.

Your guidance is wrong. "Probably" means more likely than not. According to Microsoft's own statistics Fred's XP workstation is "probably" a rooted, keylogging spambot zombie. His files safe? Get real.

On the other hand, your machine is "probably" exploited already too, so why not just give up? Everyone else has. It's not like anybody wants to read your boring data anyway, right? Besides, what are we to do? If we can't use Office, we might as well give up and go home. We can just keep clicking away those popups until the machine slows down so much it won't function at all and then Ted from IT will fix it. You didn't really like google anyway -- that targeted search assistant is so much better at finding just the right thing. It's like it knows you.

Never mind.

I'm so glad

[Cafe Alpha]

I'm so glad that I just switched to open office.

Next piece of helpful advice

[DigitAl56K]

"Do not start Windows, even when using trusted computing"

I like Notepad better anyway.

Old but still Good Advice

[Erris]

Microsoft has just taken a while to get it. See reason four.

If Microsoft is doing this to boost their next Office, they are going to be surprised by the number of people who migrate to Open Office. Really, these kinds of screw ups are nails in their coffin.

Re:Old but still Good Advice

[Anonymous Coward]

willy, I'm trying to figure out the pattern here. do you switch to your sockpuppet account when you see that you're not getting karma on the twitter one, or are you logged in from work using the sockpuppet account?

Can you open them with open office without a risk

[Anonymous Coward]

It is what I am using.

Wow...

[multimediavt]

FTFA:

Many security experts said they believe corporate espionage is the main motive behind the attacks.

Wow! If that doesn't make Corporate America take another look at an MS alternative office suite I don't know what should!?!?!?

What about 2007 ?

[billcopc]

Does anyone else find it cute that Word 2007 isn't listed as being vulnerable ? That would certainly explain why they're in no hurry to release a fix. The "fix" is to upgrade :P How convenient that Office 2007 was just released last week. You know it only takes one loaded document to scare someone's PHB into buying the "fix" impulsively. Some will surely upgrade preemptively just out of fear.

I'm not an anti-MS fanboy at all, but I do scratch my head when I see these things. Exploits every week, sloppy code all over.. why is it that a huge company like Microsoft, with its enormous installed user base, thus guaranteed income, has such tremendous issues with deadlines and quality control ? Why was Windows 95 almost Windows 96 ? Why is Vista still not out ? Are there not enough skilled developers in the world for them to hire ? Do they need better tools to assist the massive workflow ? What about the resources spent chasing down exploits and producing fixes, and the collective waste of bandwidth, labor and mindshare of "patch tuesday" all over the world... They have a company that could so easily take the lead and commit ample resources to new developments and experimental computing paradigms, instead they spend all their time playing catch-up. The longer they fidget, the bigger the opportunity for a young, dynamic contender to shape up, be it Linux, Mac, or even a newcomer. Eventually, they will meet an opponent that won't sell out; one that has the balls to stand up to them and bite off some of MS' market share, rather than trading their own defeat for some shiny MS stock. By then it will be too late to turn the sinking ship around.

Yep.

[Cybert4]

They are called women. Oops.

Re:Yep.

[mackyrae]

Fuck you.

They are more often called people whose generation means they didn't have ready access to computers throughout their childhood and adolescence to learn how to properly use a computer. Almost anyone over the age of 40 is guilty of this sort of technical ignorance. Correspondingly, those under the age of 18 tend to be afflicted with this ignorance as well. This generation is too young to remember anything about how computers work outside the world of Microsoft Windows (command line? DOS? get real!) and OS X. Between the ages of 20 and 40 are the most computer-savvy people you will find. Outside that range, anyone who is really good with a computer is that way for one or both of two reasons. The first is that they love computers and figuring out how they work. The second is that it became necessary for them to learn how computers work, usually to assist someone else who is outside the age-range of people who are the most tech-savvy.

Don't be so quick to judge women. My boyfriend learned to code FORTRAN from his mother almost twenty years ago. I'm the only member of my family who doesn't fear the command line and have been fixing family computers as long as we've had them. My mom's female cousin builds custom computers for fun. I was hanging out with a female kernel hacker last month along with a few other women from the DC LinuxChix chapter. On Sunday I took a Japanese test with a female friend who was wearing a Linux shirt. Friday night my roommate had a friend from her all-girl high school over and we were talking about graphics cards, modding our boxes, and programming. Her grandmother is a programmer; she started back during the punch-card days. A girl in my dorm builds robots. I explain some hardware components to my male boss, and I work at a computer store. One of my dad's best female friends has been programming for over 30 years. For that matter, the first programmer was a woman! Haven't you ever heard of Ada Lovelace, after whom the programming language Ada is named? How odd it is that an occupation pioneered by a woman is now seen as an exclusively male realm in spite of so much evidence to the contrary!

Re:Yep.

[linuxfanatic1024]

I'm siding with mackyrae above--she's 110% right.

And I might add that all the people I, a guy, have shown Linux to that actually switched to it were female? I've never converted another guy, but I have convinced 3 female computer geeks (they were into computers before I knew them, that is). Just because a guy shows them Linux and helps her with problems doesn't mean it was 100% his doing (I certainly can't take the credit for anything other than the demonstration). Most female Linux converts were computer geeks who simply didn't know Linux existed before.

But if you must, go live in your stupid fantasy world. Don't expect to get very far, though, if anywhere.

Exactly right

[einhverfr]

Show of hands:

How many here remember: Concept?

Yesterday my wife's Mac was 'spinning'...

[rthille]

Word was hung and using all the CPU. All Microsoft software I've ever dealt with has been crap.
Luckily it seemed to just be a corrupt document, and the version is Office Mac: Vx from 2001, so it looks like I might be safe. And my wife isn't an administrator on her own computer so that makes me feel a little better.

Still, I really should get those backups running...

As usual, more bullshit from Slashdot

[Anonymous Coward]

Microsoft suggests that users 'not open or save Word files,' even from trusted sources."

Wow... that's pretty interesting. I just read MS's technet bulletin, and it says nothing of the sort.

Protect Your PC

We continue to encourage customers follow our Protect Your PC guidance of enabling a firewall, getting software updates and installing ant-virus software. Customers can learn more about these steps by visiting Protect Your PC Web site.

* For more information about staying safe on the Internet, customers can visit the Microsoft Security Home Page.

* Customers who believe they have been attacked should contact their local FBI office or post their complaint on the Internet Fraud Complaint Center Web site. Customers outside the U.S. should contact the national law enforcement agency in their country.

All customers should apply the most recent security updates released by Microsoft to help ensure that their systems are protected from attempted exploitation. Customers who have enabled Automatic Updates will automatically receive all Windows updates. For more information about security updates, visit the Microsoft Security Web site.

* We recommend that customers exercise extreme caution when they accept file transfers from both known and unknown sources. For more information about how to help protect your computer while you use MSN Messenger, visit the MSN Messenger Frequently Asked Questions Web site.

Keep Windows Updated

* All Windows users should apply the latest Microsoft security updates to help make sure that their computers are as protected as possible. If you are not sure whether your software is up to date, visit the Windows Update Web site, scan your computer for available updates, and install any high-priority updates that are offered to you. If you have Automatic Updates enabled, the updates are delivered to you when they are released, but you have to make sure you install them.

Yep, pretty amazing, how a Slashdot posting could be so wrong about something concerning Microsoft.

Re:As usual, more bullshit from Slashdot

[Anonymous Coward]

Ahh... I see where he got the quote from. Using all the context bending logic of a Republican on that one.

From MS's statement:

Workarounds for Microsoft Word Remote Code Vulnerability:

Microsoft has tested the following workarounds. While these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified in the following section.

* Do not open or save Word files that you receive from un-trusted sources or that you receive unexpectedly from trusted sources. This vulnerability could be exploited when a user opens a specially crafted Word file.

... the Slashdotter with his raging, all-consuming hatred of all things Microsoft comes up with "Microsoft suggests that users 'not open or save Word files,' even from trusted sources".

Slashdot is to Microsoft as Republicans are to Bill Clinton.

Truth, logic, and morality are irrelevant. Hate makes all lies justified.

OT - regarding haiku

[Anonymous Coward]

Haiku is coming along, slowly but surely. Well, I say slowly, but i really don't know anything about time-tables for developing a modern OS. It's recently passed it's 5th birthday and is almost feature complete, which is to say, replicates all of the functionality of BeOS R5. almost all pieces of it are still considered "alpha" quality, though. Some of it is actually an improvement, actually. the networking in BeOS was entirely in user-space, which helped for system stability, but sucked for a good number of network tasks. haiku has moved networking into kernel space, but stays binary compatible with R5 (unlike Be Inc.'s never officially released kernel-space networking stack BONE). The file system replacement is in fact FASTER than the original BFS and is written in C++ (BFS was written in C with some assembler, iirc).

one of the neater aspects of the project is that, b/c of the extremely modular nature of BeOS's design (the so called "kits" into which the system was divided) testing any part of haiku is as simple as downloading one piece of it and replacing the old BeOS kit with the new haiku kit.

if anybody out there is really interested, one can still download the free-as-in-beer BeOS R5 from bebits.com. it's, of course, starting to show it's age, so you might have to download one of the hacked versions (the so-called Max or Developer editions) of it to get it to install and boot on some newer machines. A little searching around on bebits and google should provide all the needed info.

i'm really looking forward to the day (hopefully soon) when someone can donwload and burn a fully-installable disk image from the haiku site. i can't imagine that a really nice, user-friendly, FOSS, gui OS would be anything other than a great boon to the FOSS community. until then, i've still have my old R5 machine to play around with on occasion (i actually do some serious work on it still).

What about WordPad?

[sawilli]

I noticed that wordpad is also not on the affected software list... It might be a way to view Word documents without Word (or downloading additional word processors). Anyone know if it is also affected?

Think before you post

[l2718]

What GP was mad about is not that user processes can have bugs, but that user processes could be in a position to threaten the stability of the operating system. He's wrong about the nature of the threat we're talking about here, but that's a separate point.

Re:Think before you post

[Anonymous Coward]

I suggest you RTFAdvisory (I know, I must be new here). It doesn't threaten the security of the OS - it just gives the attacker the permissions of the user running Word. Not great, but let's not make it worse than it is (no, really, not new here, thanks).

Re:Think before you post

[Laurentiu]

I couldn't care less about the security of the OS. It's MY security that's important. OS security is a means to an end, not the end in itself. The comments "this wouldn't happen on Linux" in this case do not apply, because a poorly written application could compromise your data on Linux just as well. And loosing or leaking confidential information is as serious as it gets.

And a bit of perspective for the parent: the vast majority of Windows users are running as Admin-equivalent. That's why compromising Windows is so trivial, and that's why an exploitable hole in an user program is such big news.

Re:Think before you post

[l2718]

Actually, I was in error. GP really complained that his word-processor wasn't bug-free, which is silly. In any case what you say is obvious -- I was going to add that to my post but then decided to make it brief.

Mac exploit- arrgh!

[reaktor]

Thanks a lot, Microsoft.

-Steve Jobs

Re:Mac exploit- arrgh!

[arminw]

I wonder if this will work only on the new Intel Macs or also on the older PPC versions?

HA!

[Cafe Alpha]

Older versions of Notepad were vulnerable.

I've lost count of the times I've gotten security updates to notepad.

Re:So many versions, same bug

[Anonymous Coward]

Ribbon for the win, keyboard accessible menus are so last century.

Re:Bah, typical bullshit non-edited craptastic blu

[surfcow]

> Do not open or save Word files that you receive from un-trusted
> sources or that you receive unexpectedly from trusted sources.

You are picking nits.

Yeah, I know, Slashdot quoted Eweek who misquoted Microsoft. I just don't care.

Do you think we are somehow immune from infection by a "trusted" source? No? Then stop complaining. We don't need more lawyers in the world. More signal, less noise.

BTW, how many times did the sacred Microsoft security page use the term "root-kit"? Exactly zero. I'm glad someone is reading between the lines.

Grumble, grumble.

Re:Just to be safe..

[gwait]

I sense a great disturbance on the net - it's as if 280 million adware infected PC's were suddenly shut off!

http://www.theregister.co.uk/2005/02/02/adware_mar ket_estimate/

MS says

[moco]

MS security advisory states:

The vulnerability cannot be exploited automatically through e-mail. For an attack to be successful a user must open an attachment that is sent in an e-mail message. Now, I haven't used outlook for a while but i remember that this was possible. Does outlook use word also as the "renderer" of incoming emails? If so, is automatic infection possible just by viewing an infected message?

Exploits, Mac avaiability and Yoda

[Anonymous Coward]

Let me get this straight: the current version is security-flawed to the point of an exploit being able to destroy your system, or worst, hijack it. The NEW version is NOT available for the Mac and won't be until March (and we ALL know how reliable Microsoft release dates are, don't we?).

And the recommendation is not to open any unexpected Word Documents until a work-around, patch or other fix comes in.

And it's the holidays... and the NEW version of WORD JUST came out.......!

As Yoda would say: "Pass the smell test, this does NOT!"

What should I do?

[DeltaQH]

I do not trust a lot of my colleagues at work,and the rest of them do unexpcted things all of the time. What should do?

Whiner

[OldManAndTheC]

Look, if you want OpenOffice to have the capability to take down a machine merely by opening a compromised document, you can damn well code a patch.

Sheesh.

No different than trusting a closed source vendor

[Anonymous Coward]

No different than trusting a closed source vendor - at least if your PC is networked.
There's simply no way to check that Word isn't scanning your documents and sending info (perhaps about projects or business releationships competitive with Microsoft) to Redmond next time it does a windows update.

Probably comes in handy in DOJ investigations too - hope they didn't collect their info in .doc files.

You say Microsoft wouldn't do that? Well, I'd say Google wouldn't do that either; so I'd say overall you're about the same safe either way.

And yes, open source really is different - grep the source for "open" or "socket" system calls and you can see if it does anything tricky.

If you stick with something long enough,

[rssrss]

you will be vindicated. I have stuck with Office 97, because I have never thought that any of the "improvements" that M$ has made in newer versions of Office were worth the price of a new program. It is now too old to be affected by the latest virus. Lord, this is sweet.

Scary

[Anonymous Coward]

"Simply opening a word document will launch the exploit."

Wow, that's a scary exploit. I don't even need to receive a copy of the exploit, simply opening a word document will launch it.

Window users should exercise extreme caution.

[davro]

There are no pre-patch workarounds available. Microsoft suggests that users "not open or save Word files," even from trusted sources. "As a best practice, users should always exercise extreme caution when opening unsolicited attachments from both known and unknown sources," the company said.

The MSRC (Microsoft Security Response Center) has activated its incident response process, which includes coordination with anti-virus and security vendors and the creation of a software update.
According to the advisory, Microsoft may consider an out-of-cycle patch if necessary.

At press time on Dec. 5, there were no detection signatures available from anti-virus vendors.

This is the second major Microsoft Word zero-day attack this year. In May 2006, a sophisticated attack originating from China and Taiwan was detected using a Trojan
dropper and a backdoor with rootkit features to mask itself from anti-virus scanners.

There have been several zero-day flaws--and targeted attacks--found in Microsoft Office applications, including Excel, PowerPoint and Publisher. Many security experts said they believe corporate espionage is the main motive behind the attacks.

Personally i think they are abusing the law of attraction http://en.wikipedia.org/wiki/Law_of_Attraction_(Ne w_Age) to there advantage for better or worse.

The real story behind the story...

[shoolz]

Sometimes I feel like I'm the only one who pays attention. Fuck, MS just started checking MS Office installations for 'validity' and shutting them down in the Windows Update procedure, and suddenly now, 3 weeks before Vista launch, MS is coming out and saying there's a MAJOR Word flaw.... Geez... can we all stretch our brains to figure out what this is about?!

Latex?

[Mike Peel]

Have you tried Latex? It does essentially the same thing - it separates out the formatting from the content, and lets you get on with writing the content quickly and easily. I recently switched to it from Word, and found that although it didn't have the nice graphical interface, once I'd got a style set up it actually sped my work up. If you're on a Mac, try MacTex from http://tug.org/mactex/ .

Re:Latex?

[RemovableBait]

If you're on the Mac too, then TeXShop is a pretty decent GUI for LaTeX documents. It's universal, open-source (GPL), and ties in with MacTeX and Aqua.

Social Security - it's better than Social Darwinis

[Anonymous Coward]

Social Security - it's better than Social Darwinism.
Sure, but "Honor thy father and thy mother" and "love thy neighbor as thyself" trump them both.

Comment removed

[account_deleted]

Comment removed based on user account deletion

A clever way to combat piracy

[interstellar_donkey]

I've noticed now how nitpicky Windows XP has become about the authenticity of itself installed on a computer. For a while now, users of XP who want to update have to go through an annoying 'genuine validation' process. At certain points, Windows will simply not have access to software updates until MS is convinced that they'll go on a legal copy of their software.

So now, every few months they can come up with a new authentication scheme, and a week after they are introduced (and before they are cracked), Microsoft unleashes some sinister exploit that promises to do terrible things. When the user with a questionably authentic copy of Windows/Office/etc. goes to download the security patch for this exploit, he or she isn't allowed to do so due to the inability to validate the copy of the software as 'genuine'.

So the average Windows user who has a pirated copy is given the choice to either pay for the software or face some giant threat to their computers.

Re:No different than trusting a closed source vend

[somersault]

Eh.. if you really wanted to I'm sure there would be a way of checking exactly what you send back to the Windows Update servers. These days it's dangerous just browsing the net or opening an email on a PC using Microsoft products, it's not just obvious stuff like using Windows Update that is the security risk.

rm strcpy().

[caluml]

Forgive my ignorance, but if a lot of the buffer overflows occur because of strcpy() when alternatives like strncpy() exist, why isn't that call deleted from the library? Sure, lots of users' programs would stop compiling *, but after some gnashing of teeth at the developers, and some hurried sed/awking, we'd be rid of this pestilant plague.

A ./configure --with-strcpy-is-insecure-and-i-know-it-and-am-too -lazy-to-fix-it option could be left for those that **couldn't** be changed.

Re:rm strcpy().

[Anonymous Coward]

As ironic as it sounds, if they'd used VB.NET or C#'s mindlessly simple string copying methods (I can't remember, but I think you can just use an operator, or at WORST, "String.Copy") then they wouldn't have to worry about overflows since the Framework would already have guarded against that.

I sure do love it when people write apps in several-decades old languages for modern OSes...

Mac exploit?

[Danathar]

How does this affect the Mac?

Re:Mac exploit?

[(H)elix1]

The flaw is in Office 2004 for Mac - and on my new MacBook, they bundled a 'trial' version of Office 2004 with OSX.

what kind of a design ..

[rs232]

What kind of a design makes using a word processor dangerous. That by merely opening a text document you can totally compromise the system.

Pregnant women

[edxwelch]

"Pregnant women should not open Word documents. Opening of a Word document can seriously effect the health of your unborn child"

Re: Unifying Output of Arboreal Facilities

[Anonymous Coward]

My office makes fun of me for excessive unification of arboreal products, then they ask to borrow my copy of the bid because they lost theirs, and can't find where they scanned it.

Message to customers:

[Futurepower(R)]

Here is a message we sent to customers. Links were added for posting on Slashdot:

Everyone,

Don't use Microsoft Word. Use Open Office instead. This advice remains effective until Microsoft releases a patch, and it is installed.

Microsoft just issued a security advisory warning people not to open Microsoft Word documents unless they have the latest version of Microsoft Word, which was just released, and costs $329 for the upgrade, or $679 for the most powerful full version.

On the security advisory web page the relevant parts are buried in sections that aren't visible unless you click on them:

"Do not open or save Word files that you receive from un-trusted sources or that you receive unexpectedly from trusted sources. This vulnerability could be exploited when a user opens a specially crafted Word file."

"We recommend that customers exercise extreme caution when they accept file transfers [files] from both known and unknown sources."

The vulnerability is being actively used to infect user's computers. That's the meaning of the phrase "zero-day" attack in the first sentence of the advisory. None of the anti-virus software vendors have made signatures for this attack yet, which means that anti-virus software CANNOT protect against an attack.

The reason Microsoft says to "exercise extreme caution" with files received "from both known and unknown sources", is that no one, not even computer consultants, can know whether a source can be trusted, since the anti-virus vendors have not yet made a method of detection for this vulnerability.

Michael

There might be a temporary solution

[trifish]

Wordpad wasn't listed as affected.

Read the f*cking link

[charlieman]

YES!

As a best practice, users should always exercise extreme caution when opening unsolicited attachments from both known and unknown sources.

word files .. from trusted sources ..

[rs232]

"C'mon, did microsoft REALLY say, "'not open or save Word files,' even from trusted sources", davidsyes

"Recommendation: Do not open or save Word files that you receive from un-trusted or that are received unexpected from trusted sources. This vulnerability could be exploited when a user opens a file", microsoft.com

was SLASH! KNOCK OFF THE FUD SUBMISSIONS! (Score:5, Interesting)

Re:word files .. from trusted sources ..

[davidsyes]

Oh, but I see it wasn't flamebait when rejected submitters called certain moderators on the carpet for nearly /virtually plagiarizing the journals of others to get a story topic posted. So, I go from 5, Interesting to 0 flamebait.
I don't think it's too much to ask Slashdot to NOT ALLOW MODS/nite-staff to submit sensationalist, twisted summaries to draw readership. Keep it up and the REAL IT leadership or the companies paying for ads will dismiss Slashdot, pull the ads and force slash to reinvent itself.

Someone's knocking me down to 0, Flamebait and staying there shows Slashdot's priorities... Would be nice if a histogram or something similar would show the min/max/average/best/most-enduring score/rating of a comment rather than let an asshole here and there denigrate meaningful commentary by someone with a GENUINE assertion intended to neutralized sensationalistic, self-aggrandizing submitters from wrecking Slashdot any further.

EXCUSE~1 ..

[rs232]

was Re:Article Summary is Flamebait

what's the difference in meaning ..

[rs232]

What's the difference in meaning if any between:

"Microsoft suggests that users 'not open or save Word files,' even from trusted sources.", kdawson

and ..

"Do not open or save Word files that you receive from un-trusted or that are received unexpected from trusted sources", MS

was Re:Misleading summary

Comment removed

[account_deleted]

Comment removed based on user account deletion

use wordviewer ..

[rs232]

"Could the problem be avoided by opening the any .doc files with OO.org?"

The problem for a lot of msWord users is that the docs don't display or print correctly in OO especially if using lots of embedded frames etc. A simpler solution that would avoid even zero day exploits is to set the Word Viewer to default for Word docs and write a script that deletes normal.doc at boot. Use Firefox or Opera for browsing use thunderbird for email.

what about OO.org? (Score:5, Insightful)

Re:use wordviewer ..

[Ginger Unicorn]

didnt the article say word viewer was affected too?

Re:use wordviewer ..

[rs232]

"didnt the article say word viewer was affected too?"

Yes it does, in that case use the gmail wordviewer.

STUPID BULLSHIT

[singingjim]

Seriously. Cut the crap with this silliness. I can't open ANY Word doc? Please. That's just dumb.

Re:No different than trusting a closed source vend

[Gilmoure]

They said this one affects Office/Word 2004 on Mac as well. I wonder what the exploit does on a Mac?

Use OO to "defang"?

[Kadin2048]

I initially thought about using OpenOffice; I think it's probably the best solution overall, since it's free and you can get it right now. But let's say you absolutely need to work in Word -- how can you make sure that a document is safe?

If you opened a document in OO, and then saved it, would the resulting document be guaranteed to be clean? What if you saved it as an RTF and then opened that back up in Word? That would probably lose a lot of people's fancy formatting, but it would preserve most of the content and markup. I suppose the most paranoid thing to do would be to save all documents out to ASCII and then open them up in Word, but at that point you've negated any reason to use Word in the first place.

If OO tries to open a file, and it has a maliciously-crafted (which to OO, I assume, would appear corrupt) binary object in it, will OO refuse to open the file / remove the corrupt object? Or will it just ignore it and continue on its way?

Re:No different than trusting a closed source vend

[somersault]

Maybe the method Word uses to render itself - when used on a certain font with the right combination of letters - infects your brain somehow. I guess it's working on the same principal as flash ads.

Funny... The advisory doesn't state...

[Assmasher]

... anything resembling "Microsoft suggests that users 'not open or save Word files,' even from trusted sources."

It says to be extremely cautious.

FUD, from Slashdot? No way...

Meanwhile, back in the real world...

[freeweed]

If you aren't expecting an attachment, don't open it.

My god, have ANY of you people ever actually worked in an office before? Having to manually confirm every e-mail attachment I receive in a day would take, well, the entire day.

I can't believe this comment keeps getting modded "Insightful".

Meaning of "zero-day"

[N7DR]

So... a "zero-day" attack used to be one that appeared on the same day as the piece of software that was being attacked. Obviously, somehow the meaning of "zero-day" has changed. What does it mean now? (As far as I can tell, it's just meaningless padding, wehich means that a perfectly useful concept [that of an attack that appears on the same day as the software] now has to be explained periphrastically instead of using "zero-day". I hope I'm wrong, and that "zero-day" still does have a meaning, albeit one that's changed.) Anyone care to enlighten me?

Slightly deceptive post

[Gription]

Gee, "Microsoft Recommends" is the part of this story that is skewed in a deceptive manner.

The story above lists the exact quote, "not open or save Word files" as part of the sentence, "Microsoft suggests that users 'not open or save Word files,' even from trusted sources."

The actual quote from Microsoft's site is, "Do not open or save Word files that you receive from un-trusted sources or that you receive unexpectedly from trusted sources.", which can be checked at http://www.microsoft.com/technet/security/advisory /929433.mspx under the heading of "Workarounds for Microsoft Word Remote Code Vulnerability:" Suddenly it means something completely different. It actually describes they way you should ALWAYS treat any attachment.

Sure, we all know that MS makes stuff with lots of holes in it (like most everyone else) but that is no excuse for flagrantly deceptive reporting. I get enough of that on TV every night...

This is bad enough...

[ThinkFr33ly]

... without spreading FUD along with it. Microsoft did *not* say you shouldn't open documents "even from trusted sources". They said:

Do not open or save Word files that you receive from un-trusted sources or that you receive unexpectedly from trusted sources. This vulnerability could be exploited when a user opens a specially crafted Word file.

Re:No different than trusting a closed source vend

[Gilmoure]

One more reason for me to stick with Word 5.1a, for writing term papers (like that's ever going to happen again). 'Course, this (and SMAC/X) will keep me from moving to Intel based Mac.

The ignorance of higher-ups.

[suparjerk]

I work at a small software company and my boss doesn't seem to understand why I use OpenOffice for all my stuff. Maybe I'll send him this article.

Re:No different than trusting a closed source vend

[ericlondaits]

But I *KNOW* that Microsoft Word is not transferring whatever I type to Microsoft or other third party (the network traffic would be a giveaway)... and I also *KNOW* that Google keeps the full text (and all revisions) of whatever I write in Google Docs.

Even if they "do no evil", they could be forced by law (or hacking) to release my documents.

Anyway, Google Docs is not a replacement for MS Word (yet, at least)... but rather to Wordpad. It lacks even basic word processor functionality. I still like it and use it, but more in a collaborative "closed wiki" fashion.

Re:Social Security - it's better than Social Darwi

[ultranova]

Social Security - it's better than Social Darwinism.
Sure, but "Honor thy father and thy mother" and "love thy neighbor as thyself" trump them both.

Since Social Security in no way stops you from honoring or loving anyone, I'm a bit uncertain what's your point. After all, all Social Security does is ensures that even those of us who don't have children or rich friends won't starve when we become too old or sick to work.

Unless, of course, you are suggesting that it's good to have people starve on the streets so you can look good by giving them a few bread crumbs ? That particular line is what I've heard some people use to argue against Social Security...

Re:So many versions, same bug

[scribblej]

Imagine if they took the "Vista Sound" team and put them on fixing this bug!

We'd end up with a Word that would play a funeral dirge when you opened a compromised e-mail.

No Opening or Saving?

[fltsimbuff]

"...Microsoft suggests that users 'not open or save Word files,' even from trusted sources."

Phew! I almost clicked the save button on my 25 page term paper before I read that! Thank God for Slashdot!

Its a good thing

[Darkman, Walkin Dude]

Microsoft is just taking the paperless office to the next level - the documentless office.

I would imagine both PPC and Intel

[BancBoy]

If Microsoft hasn't updated the Mac version of Office to be Universal Binary, Word is already running under Rosetta on Intel Macs. So the exploit should work on both plaforms. Possibly a little slower on the Intel machine due to the extra layer of emulation. :)

Re:Social Security - it's better than Social Darwi

[wolrahnaes]

After all, all Social Security does is ensures that even those of us who don't have children or rich friends won't starve when we become too old or sick to work.

That's what a retirement fund is for.

What's that? You didn't think to start one?

Sucks to be you, the world's not fair.

When Full Disclosure Can Be Good

[wwest4]

So there's no patch, there's no practical workaround, there are no av signatures, and there is no official explanation of the exploit mechanism. Hmm. What's a guy to do?

Re:When Full Disclosure Can Be Good

[Douglas Goodall]

You have just been kicked in the balls by Microsoft. What should you do? Remember this the next time you think about specifying Microsoft products at your business. I am not happy about this. I don't like this disruption to busnesses. But I am paying attention.

OK, I can't be the only one to expect this...

[Miss Spider]

From:
To: All_Employees
Subject: Corporate Security Alert
Significance: High

Microsoft has announced a security alert pertaining to MSWord - probably all versions. Microsoft recommends not opening any MSWord documents from anyone, until further notice. Please see attached for details.

Thank you,
IT Department

[attachment - MSSecurityAlertDetails.doc - 1,253KB]

The viewer too?

[Anonymous Coward]

The thing that astounds me more than that is that the Viewer is affected too. One step closer to a PDF based virus, I'd say... Adobe, stay away from active content. I mean really, who needs active content in a word processing document? Presentations I understand, so seriously, are you going to put active content in your Ph.D thesis? Why Why Why???

Re:The viewer too?

[lahvak]

Not on PhD thesis, as it is going to be printed anyway, but it can be very useful in education.

i'm safe

[icebones]

unpatched flaw, which affects Microsoft Word 2000, Microsoft Word 2002, Microsoft Office Word 2003, Microsoft Word Viewer 2003, Microsoft Word 2004 for Mac and Microsoft Word 2004 v. X for Mac. The Microsoft Works 2004, 2005 and 2006 suites are also affected because they include Microsoft Word.

well, i'm still using the outdated and unsuported office '97, so I guess I'm safe :)

COM/DCOM/ActiveX/...

[argent]

A Word document is a stream of COM data objects. This is one reason why Word documents can't be made backwards compatible, and since it's in Microsoft's interest to force users to upgrade over time they have little incentive to change this design.

The problem is that unless they take steps to prevent it, and COM object that's supported on the system can be theoretically includes or referenced, including ActiveX controls. Just as in Internet Explorer and Outlook, they try and filter out "dangerous" components... but over the 7 years since they introduced IE they've been unable to solve the problem.

And they have too much face tied up in the design to easily back out even if they wanted to. And, as noted, they have little reason to want to.

Re:COM/DCOM/ActiveX/...

[rs232]

"A Word document is a stream of COM data objects. This is one reason why Word documents can't be made backwards compatible"

Is it possible to provide such functionality without turning the document into code. Remember when there was two kind of binary, data and code. If you don't download code then you can't download 'viruses'.

Re:COM/DCOM/ActiveX/...

[argent]

Is it possible to provide such functionality without turning the document into code.

The document isn't code, it's COM data objects. They don't need to contain code, in fact they usually contain references to COM objects and serialized copies of the associated data.

The problem is that the distinction between data and code is slippery. Macros, for example, are not executable machine code but they do execute. An object can encapsulate a DLL in a scrambled form that's not recognisable as code (for example, a portion of an image file) and a macro to extract the code and execute or install it.

Re:COM/DCOM/ActiveX/...

[rs232]

"The document isn't code, it's COM data objects. They don't need to contain code, in fact they usually contain references to COM objects"

That's just a matter of semantics. A reference to a COM object in a Word doc is the same as a Word doc executing something. COM objects are certanly not data, if written as C++ classes they contain both encapsulated functions and data. As such they can 'do' something. As such the design is flawed. As in opening a Word doc is opening you up to executing someone elses COM data object. As such you have to trust the sender.

Re:COM/DCOM/ActiveX/...

[argent]

A reference to a COM object in a Word doc is the same as a Word doc executing something.

A reference to a COM object in an Internet Explorer document is the same as the reference to a COM object in a Word document. But the HTML document isn't code, the same HTML document in any other browser renders fine without invoking COM, because the format is abstract enough that the tags Microsoft interprets as being a COM object Mozilla interprets directly.

As such the design is flawed.

Well of course it's flawed. It should be abstract enough that implementation details (like COM) simply aren't embedded into it. My point wasn't that it's not flawed, it's that even if you try and filter out the "code" objects you can still be penetrated. Just like you can in Internet Explorer.

The Immunity of Obsolescence?

[HTH NE1]

One more reason for me to stick with Word 5.1a, for writing term papers (like that's ever going to happen again). 'Course, this (and SMAC/X) will keep me from moving to Intel based Mac.

It hasn't stopped me from moving to an Intel Mac. I just don't get rid of my old machines and use a KVM switch. Though the PowerMac 7500/100 isn't getting much use anymore, even with the B&W G3's original processor in it (the B&W was upgraded to a faster G4 than my stock G4 Cube has).

Now if only I could find a KVM solution for the older Macs that use DA-15 and ADB, though I'd probably have more luck finding DA-15->VGA and ADBUSB adapters.

The networking problem is child's play compared to that. Except... does anyone know if, after all the necessary bridges are connected, I could boot my Apple IIgs off of NAS?

Re:The Immunity of Obsolescence?

[Gilmoure]

I figure I'll end up keeping a PPC machine running classic on the network and just remote desktop into it. Just need to get a 10 person OS X server install...

I think you'd be surprized....

[ProfessionalCookie]

at how many professors would accept "zero-day Word Exploit." In fact I think I have a solution for you.

Open Office

[Fuzzums]

Does anybody know if Open Office is affected?
Can you safely open (infected) word documents in OO at this moment?

Processing power runs out after 60 minutes?

[tepples]

The compiler should take care of all the optimazation

Should != does. I ran the following file hello.cpp through the version of G++ included with the most recent MinGW bundle:

#include <iostream>
using std::cout;

int main() {
cout << "Hello world\n";
return 0;
}

The size of the stripped executable hello.exe was 266,240 bytes. Compare hello.c, which ideally should be semantically equivalent:

#include <stdio.h>

int main(void) {
fputs("Hello world\n", stdout);
return 0;
}

GCC produced a 5,632 byte stripped executable.

we have processing power now

But if that power runs out in 60 minutes because that was the largest battery that could fit in the device, what good is it? Even on desktop PCs, why are we writing the majority of applications in C++ and not, say, Python if Python is so much safer?

C or C++ are languages btw, you have several compilers that process C or C++ code, so are you saying a compiler you've used or think MS has used is flawed or the language in itself?

The C++ standard is eight years old. If the two most popular implementations (Microsoft and GNU) have the same flaw by now, then it is more likely than not that the language itself has a flaw that shows in all conforming implementations.

Sounds like a great way to deal with Piracy

[VGfort]

for any people that share their apps with relatives and can't update. :p

Reply from a CEO:

[Futurepower(R)]

A CEO, whose name I have changed to James, replied to version he received of my message above: "OK, so what do I do if I receive a WORD doc that I am expecting, from someone I know? If I need to see it, what should I do? Any idea how long until this latest craziness is over? James" My reply:

James,

There is no vulnerability in Open Office Writer. Just save the .DOC file or .RTF file to the hard drive and open it in Open Office. You have the latest version of Open Office, which is very compatible with MS Office. If you like, we will make it so that all .DOC files open automatically in O.O. Writer throughout [the organization].

I have no idea when this will be fixed. However, Microsoft must know more than is being said, since the company is using such strong language: "exercise extreme caution [with files] from both known and unknown sources."

When I try to translate that from corporate-speak to English, I wonder about the meaning of "exercise extreme caution". How would I do that? Would I hold my finger to the side of my nose very tightly and hope, hope, hope? Is there an animal in a closet called extreme caution, and I would take it out for exercise?

Since there is no way to know if a file is infected, and since merely opening an infected file causes your network to be infected, my translation of that statement from Microsoft is:

"Don't use Microsoft Word."

The following alternative translation is preferred by many computer professionals who have been discussing Microsoft's advice online: "Pay $329 for an upgrade to the latest version immediately." I won't bother with the corporate-speak version of my answer to that. The English version is "When pigs fly".

You now have an excellent opportunity to become accustomed to Open Office, which is better anyway, and saves files in Microsoft Word .DOC format as well as the ISO (International Standards Organization) Open Document Format.

It's a weird world out there, James. If you want to put your computer systems at risk, you will have to pay a lot more for software you already own, for a version that is very little different, with the assurance that there will be other severe vulnerabilities. If you want relative safety, using software that is less quirky, you will have to keep your money in your pocket.

Michael

Parent is LYING about the Mac hack competition

[Anonymous Coward]

For starters, the competition gave out local accounts to anyone on request. Hardly a situation that's going to happen on a normal user's Mac.

Second, all that happened was that the hacker used an Apache privilege escalation exploit to modify index.html. That's it.

That entire Apple-hating post you just read was based on someone modifying index.html via an Apache bug. I've never seen such vitriol over something so lame. Face it, Microsoft has another embarrassing flaw. Citing lame stuff like MySpace vulnerabilities or old 2003-era AirPort bugs isn't going to change that. Deal with it and move on.

Gmail previewers

[hadaso]

Gmail has previewers for M$ Office documents.

I ALWAYS use them for reading Office documents in incoming mail (I forward them to Gmail. Takes an extra 2 seconds).

Perhaps it's a good time for Google to make it work better. Like show images as an option.

What kind of exploit is this? If I run Word in a limited Windows account, am I not protected? (what if I create an account just for reading Office docs that cannot be trusted in the same environment as other things?)

Re:Social Security - it's better than Social Darwi

[ultranova]

Sucks to be you, the world's not fair.

Then what are you complaining about ?

And the world would be a lot less unfair if people stopped using the perceived unfairness as an excuse to behave in ways that make it even more unfair.

It's Not About Apple Mac OS vs Windows

[Douglas Goodall]

This is about every known version of word having a vulnerability for which there is no patch or update. This isn't the place to argue about Mac OS. This is about an unleashed weapon of mass destruction like we have been worrying about where the infrastructure of the country that includes millions of Windows systems running Office are now vulnerable to the most simple of attacks. Microsoft better have a lot of "Error and Ommisions" insurance. They are already being sued by at least one state for releasing insecure buggy code. This situation is intolerable. It throws most companies into a tizzy of paranoia about the use of Word documents. I think there is a good case for Open Office today. I simply don't use Microsoft Office anymore. This isn't about I told you so. It must be obvious that cracks are appearing in the Microsoft code monopoly. Microsoft fanboys may want to reconsider their position.

For one RMS and BG agree

[Coeurderoy]

The Free Software Fondation is still under shock but they plan to shortly release their first ever news bulletin where they DO agree with Microsoft.

Do not open or save a Word document, yes!

Could Microsoft also recommend not to use the Windows(TM) Operating System ? the FSF is ready to offer them a Free (as un beer) DVD with a Free (as in speech) Operation System on it! (well at least somebody told me so ;-))

I love a good text editor

[donak]

Like for example win32pad, a notepad replacement:
http://www.gena01.com/win32pad/
Just forget word and/or pretty formatting for a few days, and learn to spell!

Does this affect Word 97 SR-2 ?

[lpoulsen]

Can I assume that the only reason Word 97 is not mentioned on the list of affected products is because Office 97 is no longer supported? Or would I be justified in saying "Whew, we dodged a big one ere by sticking with trusty old Office 97 in this company?"

Is there a non-MS article somewhere that may answer such questions?

It seems to me that this may be an effective way to finally get people to drop Office 97.

Is Word 97 safe? I don't think so

[lpoulsen]

I think that the only reason Word 97 is not listed as affected is because it is no longer supported.

Re:Social Security - it's better than Social Darwi

[wolrahnaes]

Then what are you complaining about ?

People who take my money in an effort to make things fair for the poor/retired/whatever. I have a job and am saving money for retirement. Why should I pay for those who fucked up?

Re:Social Security - it's better than Social Darwi

[ultranova]

People who take my money in an effort to make things fair for the poor/retired/whatever. I have a job and am saving money for retirement. Why should I pay for those who fucked up?

Thank you for demonstrating why Social Security needs to be enforced by force and the State, rather than left for voluntary charity.

Now please answer my question: if "Sucks to be you, the world's not fair" is your answer to those less fortunate or wise as you, then what grounds do you have to complain when you perceive it being unfair against you ? Maybe it sucks to pay for those who fucked up - or were fucked over - but hey, the world's not fair, right ?

Too. Much. Talking.

[Cybert4]

Stereotypes are there for a reason!

Yeesh.

Re:Too. Much. Talking.

[linuxfanatic1024]

Yeah, they're for idiots like you to take as the sacred "truth"! Sheesh.

Onus of proof?

[alexo]

Obviously Microsoft is updating their old programs to have exploits that their new ones don't. And before you say prove it, you prove they are not.

Obviously you are a necro-pedo-zoophile. And before you say prove it, you prove you are not.